---
title: "Confirm authenticator enrollment"
method: PUT
path: "/v1/users/self/mfa/totp/confirm"
tags: ["Authentication"]
---

# Confirm authenticator enrollment

`PUT /v1/users/self/mfa/totp/confirm`

## Request

- Base URL: `https://api.assinafy.com.br`
- URL: `https://api.assinafy.com.br/v1/users/self/mfa/totp/confirm`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Api-Key`

Activates the method by proving one live code from the NEW device (`code`). Returns the recovery codes, which are shown only once and cannot be retrieved again. From this point every login requires a second factor. If the user already has a confirmed method of the same type, confirming REPLACES it — the old one is soft-deleted and recovery codes are reissued — so this call additionally requires re-authentication via `password` or `reauth_code` (a live code from the CURRENT device, or one of the existing recovery codes), exactly like disabling a method. First-time enrollment needs neither.

[Copy as Markdown](https://api.assinafy.com.br/v1/docs/markdown?method=put&path=%2Fv1%2Fusers%2Fself%2Fmfa%2Ftotp%2Fconfirm) [Open in ChatGPT](https://chatgpt.com/?q=Read%20the%20API%20documentation%20at%20https%3A%2F%2Fapi.assinafy.com.br%2Fv1%2Fdocs%2Fmarkdown%3Fmethod%3Dput%26path%3D%252Fv1%252Fusers%252Fself%252Fmfa%252Ftotp%252Fconfirm%20and%20help%20me%20integrate%20this%20endpoint.) [Open in Claude](https://claude.ai/new?q=Read%20the%20API%20documentation%20at%20https%3A%2F%2Fapi.assinafy.com.br%2Fv1%2Fdocs%2Fmarkdown%3Fmethod%3Dput%26path%3D%252Fv1%252Fusers%252Fself%252Fmfa%252Ftotp%252Fconfirm%20and%20help%20me%20integrate%20this%20endpoint.)

## Request body

- object
  - `id` string, required
  - `code` string, required: Live code from the NEW device being confirmed.
  - `password` string, password: Re-authentication proof, required only when replacing an existing confirmed method.
  - `reauth_code` string: Re-authentication proof alternative to password: a live code from the CURRENT device, or a recovery code. Required only when replacing an existing confirmed method.

## Response `200`

Two-factor enabled

- object: Standard success wrapper. Operations add their own `data`.
  - `status` integer: HTTP status code, mirrored in the body.
  - `message` string: Human-readable message; empty on success.
  - `data` object
    - `recovery_codes` string[]

## Other responses

- `400`: One or more fields failed validation.
- `401`: Missing or invalid credentials.
- `404`: The requested resource does not exist.
- `500`: Unexpected server error.

## Changes

- **2026-10-06** `f231647afa04`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/assinafy/apis/assinafy-api-reference/changes/v1/users/self/mfa/totp/confirm/put.md)

---

[API](https://skmtc.dev/assinafy/apis/assinafy-api-reference.md) - [All operations](https://skmtc.dev/assinafy/apis/assinafy-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/assinafy/apis/assinafy-api-reference/revisions/f7da81a5567e?raw)