Post
/api/v1/users.enableTotp
Starts the TOTP enrollment for your own account and returns the shared secret and the url to render as a QR code in an authenticator app. Call users.validateTotp with a code from the app to finish the enrollment.
This endpoint requires two-factor verification, so the account owner confirms their identity with an existing second factor before a new authenticator is registered. Requests are limited to five per minute.
This endpoint replaces the deprecated 2fa:enable real-time method, which remains available until 9.0.0.
Changelog
| Version | Description |
|---|---|
| 8.8.0 | Added |
Header parameters
X-Auth-Token
stringRequired
The authToken of the authenticated user.
X-User-Id
stringRequired
The userId of the authenticated user.
X-2fa-Code
stringRequired
The 2FA code.
X-2fa-method
stringRequired
The 2FA method. It can be email, totp, or password.
Responses
200
OK
Success Example
{
"secret": "KZ3EAT7RJVHUYQ2C",
"url": "otpauth://totp/Rocket.Chat:dana.reyes?secret=KZ3EAT7RJVHUYQ2C&issuer=Rocket.Chat",
"success": true
}object
secret
string
url
string
success
boolean
400
Bad Request
TOTP Required
{
"success": false,
"error": "TOTP Required [totp-required]",
"errorType": "totp-required",
"details": {
"method": "password",
"codeGenerated": false,
"availableMethods": []
}
}object
success
boolean
error
string
errorType
string
details
object
method
string
codeGenerated
boolean
availableMethods
Array of object
object
401
Unauthorized
Authorization Error
{
"status": "error",
"message": "You must be logged in to do this."
}object
status
string
message
string