> ## Documentation Index
> Fetch the complete documentation index at: https://developer.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate TOTP Code

> Finishes the TOTP enrollment started with `users.enableTotp` by validating a code from the authenticator app, and returns the backup `codes` for the account. The other login tokens of the account are rotated, except personal access tokens.

This endpoint requires two-factor verification. Requests are limited to five per minute.

This endpoint replaces the deprecated `2fa:validateTempToken` real-time method, which remains available until 9.0.0.

### Changelog
| Version | Description |
| ------- | ----------- |
| 8.8.0   | Added       |

## OpenAPI

````json POST /api/v1/users.validateTotp
{
  "openapi": "3.0.0",
  "info": {
    "version": "1.0.0",
    "title": "Authentication"
  },
  "servers": [
    {
      "url": "https://apiexplorer.support.rocket.chat"
    }
  ],
  "tags": [
    {
      "name": "Authentication"
    },
    {
      "name": "Two-Factor Authentication"
    }
  ],
  "paths": {
    "/api/v1/users.validateTotp": {
      "post": {
        "tags": [
          "Two-Factor Authentication"
        ],
        "summary": "Validate TOTP Code",
        "description": "Finishes the TOTP enrollment started with `users.enableTotp` by validating a code from the authenticator app, and returns the backup `codes` for the account. The other login tokens of the account are rotated, except personal access tokens.\n\nThis endpoint requires two-factor verification. Requests are limited to five per minute.\n\nThis endpoint replaces the deprecated `2fa:validateTempToken` real-time method, which remains available until 9.0.0.\n\n### Changelog\n| Version | Description |\n| ------- | ----------- |\n| 8.8.0   | Added       |",
        "operationId": "post-api-v1-users.validateTotp",
        "parameters": [
          {
            "$ref": "#/components/parameters/Auth-Token"
          },
          {
            "$ref": "#/components/parameters/UserId"
          },
          {
            "name": "X-2fa-Code",
            "in": "header",
            "description": "The 2FA code. ",
            "required": "true",
            "schema": {
              "type": "string"
            }
          },
          {
            "schema": {
              "type": "string"
            },
            "in": "header",
            "name": "X-2fa-method",
            "description": "The 2FA method. It can be `email`, `totp`, or `password`.",
            "required": "true"
          }
        ],
        "requestBody": {
          "required": "true",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "code": {
                    "type": "string",
                    "description": "The code shown by the authenticator app for the account.",
                    "example": "482913"
                  }
                },
                "required": [
                  "code"
                ],
                "additionalProperties": "false"
              },
              "examples": {
                "Example 1": {
                  "value": {
                    "code": "482913"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "codes": {
                      "type": "array",
                      "description": "The backup codes of the account.",
                      "items": {
                        "type": "string"
                      }
                    },
                    "success": {
                      "type": "boolean"
                    }
                  },
                  "required": [
                    "codes",
                    "success"
                  ],
                  "additionalProperties": "false"
                },
                "examples": {
                  "Success Example": {
                    "value": {
                      "codes": [
                        "3f7a1c9d",
                        "90b2e4a6"
                      ],
                      "success": "true"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "success": {
                      "type": "boolean"
                    },
                    "error": {
                      "type": "string"
                    },
                    "errorType": {
                      "type": "string"
                    }
                  }
                },
                "examples": {
                  "Invalid code": {
                    "value": {
                      "success": "false",
                      "error": "[invalid-totp]",
                      "errorType": "invalid-totp"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/authorizationError"
          }
        }
      }
    }
  },
  "components": {
    "parameters": {
      "Auth-Token": {
        "name": "X-Auth-Token",
        "in": "header",
        "description": "The `authToken` of the authenticated user.",
        "required": "true",
        "schema": {
          "type": "string",
          "example": "RScctEHSmLGZGywfIhWyRpyofhKOiMoUIpimhvheU3f"
        }
      },
      "UserId": {
        "name": "X-User-Id",
        "in": "header",
        "description": "The `userId` of the authenticated user.",
        "required": "true",
        "schema": {
          "type": "string",
          "example": "rbAXPnMktTFbNpwtJ"
        }
      }
    },
    "responses": {
      "authorizationError": {
        "description": "Unauthorized",
        "content": {
          "application/json": {
            "schema": {
              "type": "object",
              "properties": {
                "status": {
                  "type": "string"
                },
                "message": {
                  "type": "string"
                }
              },
              "x-examples": {
                "Authorization Error": {
                  "status": "error",
                  "message": "You must be logged in to do this."
                }
              }
            },
            "examples": {
              "Authorization Error": {
                "value": {
                  "status": "error",
                  "message": "You must be logged in to do this."
                }
              }
            }
          }
        }
      }
    }
  }
}
````