---
title: "POST /api/ee/mfa/enroll/confirm"
method: POST
path: "/api/ee/mfa/enroll/confirm"
tags: ["/api/ee/mfa"]
---

# POST /api/ee/mfa/enroll/confirm

`POST /api/ee/mfa/enroll/confirm`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/ee/mfa/enroll/confirm`
- Auth: API key in header `X-API-Key`

Confirm TOTP enrollment by verifying a code from the authenticator app. Activates the second
  factor and returns the single-use recovery codes — the only time they exist in plaintext.

## Request body

- object
  - `code` string, required: value must be a non-blank string.

## Response `2XX`

Successful response

- object
  - `recovery_codes` string[], required

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/ee/mfa/enroll/confirm/post.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)