MFAService
Finish TOTP Enrollment
Verify the first TOTP code and activate the factor.
Request
curl --request POST \ \
--url 'https://api.testnet.polyester.com/v1/auth/mfa/totp:finish-enrollment' \
--header 'Accept: */*' \
--header 'X-API-KEY-ID: YOUR_API_KEY_ID' \
--header 'X-API-TIMESTAMP: YOUR_API_TIMESTAMP' \
--header 'X-API-SIGNATURE: YOUR_API_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
"code": "123456",
"enrollmentId": "mfa_22222222222222222222222222222222"
}'Responses
{
"accessToken": "eyJhbGciOiJFZERTQSJ9.example.signature",
"accessTokenExpiresAt": "2025-01-01T00:00:00Z",
"factor": {
"createdAt": "2025-01-01T00:00:00Z",
"factorId": "mfa_33333333333333333333333333333333",
"factorType": "TOTP",
"label": "Primary Authenticator",
"lastUsedAt": "2025-01-01T00:00:00Z"
},
"recoveryCodes": [
"POLY-7H2K-9M4Q"
],
"session": {
"authTime": "2025-01-01T00:00:00Z",
"authenticationMethods": [
"totp"
],
"sessionId": "session_01J0EXAMPLE",
"sessionLevel": "PRIMARY_AUTHENTICATED"
}
}Current 6 to 8 digit code from the authenticator app.
Enrollment challenge identifier returned by BeginTOTPEnrollment.
MFA factor identifier. Format: "mfa_" followed by 32 lowercase hex characters.
mfa_33333333333333333333333333333333Type of enrolled factor.
TOTPHuman-friendly label for the factor. Empty when no label is set.
Primary AuthenticatorTime when the factor was enrolled.
2025-01-01T00:00:00ZTime when the factor was last used. Empty if the factor has not been used.
2025-01-01T00:00:00ZOne-time recovery codes generated for the account. Store these securely; they are only returned in this response.
["POLY-7H2K-9M4Q"]Stable session identifier shared by the primary and MFA-elevated tokens.
session_01J0EXAMPLEAssurance level represented by this session response.
PRIMARY_AUTHENTICATEDAuthentication methods used for this session state, such as wallet, TOTP, passkey, or recovery code. Maximum 8 unique values.
["totp"]Time when the session was authenticated or elevated.
2025-01-01T00:00:00ZMFA-elevated session token issued after successful enrollment.
eyJhbGciOiJFZERTQSJ9.example.signatureTime when access_token expires.
2025-01-01T00:00:00Z| Key | Status | Error | When |
|---|---|---|---|
| unauthenticated | 401 | Unauthenticated | Authentication required. |
| permission-denied | 403 | Permission Denied | Permission denied. |
| invalid-argument | 400 | Invalid Argument | Invalid argument. |
| not-found | 404 | Not Found | Not found. |
| unavailable | 503 | Unavailable | Service unavailable. |