Post
/api/v1/users.validateTotp
Finishes the TOTP enrollment started with users.enableTotp by validating a code from the authenticator app, and returns the backup codes for the account. The other login tokens of the account are rotated, except personal access tokens.
This endpoint requires two-factor verification. Requests are limited to five per minute.
This endpoint replaces the deprecated 2fa:validateTempToken real-time method, which remains available until 9.0.0.
Changelog
| Version | Description |
|---|---|
| 8.8.0 | Added |
Header parameters
X-Auth-Token
stringRequired
The authToken of the authenticated user.
X-User-Id
stringRequired
The userId of the authenticated user.
X-2fa-Code
stringRequired
The 2FA code.
X-2fa-method
stringRequired
The 2FA method. It can be email, totp, or password.
Body parameters
Example 1
{
"code": "482913"
}object
code
string Required
The code shown by the authenticator app for the account.
Example482913
Responses
200
OK
Success Example
{
"codes": [
"3f7a1c9d",
"90b2e4a6"
],
"success": true
}object
codes
Array of string
The backup codes of the account.
string
success
boolean
400
Bad Request
Invalid code
{
"success": false,
"error": "[invalid-totp]",
"errorType": "invalid-totp"
}object
success
boolean
error
string
errorType
string
401
Unauthorized
Authorization Error
{
"status": "error",
"message": "You must be logged in to do this."
}object
status
string
message
string