Complete a two-step login by enrolling a second factor for the first time. This happens when a user without MFA enrolled logs in for the first time after the instance starts requiring MFA.

After confirming their email and password, the user will see an MFA enrollment screen, served by POST /session after it accepts the password. That body includes a single-use, signed JWT similar to the one used by an MFA challenge (see POST /mfa/verify above) as well as the details needed to show the QR code for enrolling MFA.

This request must include the JWT (enrollment_token) and the OTP itself (code). If enrollment succeeds, both the pending enrollment and the JWT's jti are consumed, preventing reuse of either.

A successful response sets the session cookie, logging the user in! Its body contains the recovery codes in the same form as enrollment when already authenticated.