Authentication

Confirm authenticator enrollment

Changed on

Activates the method by proving one live code from the NEW device (code). Returns the recovery codes, which are shown only once and cannot be retrieved again. From this point every login requires a second factor. If the user already has a confirmed method of the same type, confirming REPLACES it — the old one is soft-deleted and recovery codes are reissued — so this call additionally requires re-authentication via password or reauth_code (a live code from the CURRENT device, or one of the existing recovery codes), exactly like disabling a method. First-time enrollment needs neither.

Copy as Markdown Open in ChatGPT Open in Claude

put/v1/users/self/mfa/totp/confirm

Request

  • Base URL
    https://api.assinafy.com.br
  • URL
    https://api.assinafy.com.br/v1/users/self/mfa/totp/confirm
  • Auth
    • HTTP bearer
    • or API key in header X-Api-Key

Request body

idstring required
codestring required

Live code from the NEW device being confirmed.

passwordstring password

Re-authentication proof, required only when replacing an existing confirmed method.

reauth_codestring

Re-authentication proof alternative to password: a live code from the CURRENT device, or a recovery code. Required only when replacing an existing confirmed method.

Example request

{
  "id": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
  "code": "123456"
}

Response

Two-factor enabled

statusinteger

HTTP status code, mirrored in the body.

messagestring

Human-readable message; empty on success.

Example response

{
  "status": 200,
  "data": {
    "recovery_codes": [
      "ABCD-EFGH-JKMN"
    ]
  }
}

Changes