Verify Mfa

POST /auth/mfa-verify

No credential

This operation is public: it authenticates by its own mechanism — a webhook signature or a channel token — rather than by a platform credential.

Request body — MfaVerifyRequest

Field	Type		Notes
challenge_token	string	required	min length 16 max length 4096
code	string	required	min length 6 max length 32

Responses

Status	Description	Body
200	Successful Response	TokenPair
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

The body shows the fields the schema always carries. Which combination is legal is a service rule the schema cannot express, so read the description above before copying this.

curl -X POST https://your-deployment.example.com/auth/mfa-verify \
  -H "Content-Type: application/json" \
  -d '{
       "challenge_token": "string",
       "code": "string"
     }'

Response — TokenPair

Field	Type		Notes
access_token	string	required	—
refresh_token	string	required	—
token_type	string	optional	Default "bearer".
expires_in	integer	required	—
principal	PrincipalView	required	—