Authenticates a user who has completed MFA enrolment, and returns the credentials used by every other endpoint. Send the username and password issued during onboarding together with a current TOTP code generated from the secret registered via POST /mfa/enable. A user who has not enrolled receives 403 here until they do.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Invalid request. Returned when the Authorization header is absent, when a required body field is missing, or when mfaCode is not exactly six digits. Field errors return {"message":"
Authorization header present but empty, or rejected by the identity provider.
MFA is not enabled for this user. The credentials were accepted but no authenticator is registered, so the user must complete POST /mfa/enable first.
The username or password was not accepted. The identity provider does not distinguish an unknown user from a wrong password, and the passed-through body carries no detail.
The mfaCode was six well-formed digits but did not match the user's registered authenticator, passed through from the identity provider. Retry with a freshly generated code; if it keeps failing, check the client clock for drift.