Setup Mfa

POST /auth/mfa/setup

The secret is returned once. No endpoint reads it back.

Role floor

Requires viewer or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Responses

Status	Description	Body
200	Successful Response	MfaSetup

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

curl -X POST https://your-deployment.example.com/auth/mfa/setup \
  -H "Authorization: Bearer $COBRE_TOKEN"

Response — MfaSetup

Field	Type		Notes
provisioning_uri	string	required	—
secret	string	required	—