auth.v1.MFAService
VerifyRecoveryCodeChallenge
Verify an MFA challenge with a recovery code.
Request
curl --request POST \ \
--url 'https://api.testnet.polyester.com/auth.v1.MFAService/VerifyRecoveryCodeChallenge' \
--header 'Content-Type: application/json' \
--header 'Connect-Protocol-Version: 1' \
--data '{
"challengeId": "mfa_11111111111111111111111111111111",
"recoveryCode": "POLY-7H2K-9M4Q"
}'Responses
{
"accessToken": "eyJhbGciOiJFZERTQSJ9.example.signature",
"accessTokenExpiresAt": "2025-01-01T00:00:00Z",
"session": {
"authTime": "2025-01-01T00:00:00Z",
"authenticationMethods": [
"totp"
],
"sessionId": "session_01J0EXAMPLE",
"sessionLevel": "PRIMARY_AUTHENTICATED"
},
"stepUpExpiresAt": "2025-01-01T00:00:00Z",
"stepUpToken": "eyJhbGciOiJFZERTQSJ9.step-up.signature"
}auth.v1.VerifyRecoveryCodeChallengeRequestauth.v1.CompleteMFAChallengeResponseChallenge identifier returned by BeginMFAChallenge.
One-time recovery code. Accepted format is 8 to 64 letters, numbers, or hyphens.
Stable session identifier shared by the primary and MFA-elevated tokens.
Assurance level represented by this session response.
Authentication methods used for this session state, such as wallet, TOTP, passkey, or recovery code. Maximum 8 unique values.
Time when the session was authenticated or elevated.
MFA-elevated session token returned after every successful challenge.
Time when access_token expires.
Fresh step-up token returned for fresh step-up challenges. Empty for session-elevation challenges.
Time when step_up_token expires. Empty when no step_up_token is returned.
| Key | HTTP status | Connect code | Error | When |
|---|---|---|---|---|
| unauthenticated | 401 | unauthenticated | Unauthenticated | Authentication required. |
| permission-denied | 403 | permission_denied | Permission Denied | Permission denied. |
| invalid-argument | 400 | invalid_argument | Invalid Argument | Invalid argument. |
| not-found | 404 | not_found | Not Found | Not found. |
| unavailable | 503 | unavailable | Unavailable | Service unavailable. |