---
title: "POST /api/session/mfa/enroll"
method: POST
path: "/api/session/mfa/enroll"
tags: ["/api/session"]
---

# POST /api/session/mfa/enroll

`POST /api/session/mfa/enroll`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/session/mfa/enroll`
- Auth: API key in header `X-API-Key`

Complete a two-step login by *enrolling* a second factor for the first time. This happens when a user without
  MFA enrolled logs in for the first time after the instance starts *requiring* MFA.

  After confirming their email and password, the user will see an MFA enrollment screen, served by `POST /session`
  after it accepts the password. That body includes a single-use, signed JWT similar to the one used by an MFA
  challenge (see `POST /mfa/verify` above) as well as the details needed to show the QR code for enrolling MFA.

  This request must include the JWT (`enrollment_token`) and the OTP itself (`code`). If enrollment succeeds, both
  the pending enrollment and the JWT's `jti` are consumed, preventing reuse of either.

  A successful response **sets the session cookie, logging the user in!** Its body contains the recovery codes
  in the same form as enrollment when already authenticated.

## Request body

- object
  - `code` string, required: value must be a non-blank string.
  - `enrollment_token` string, required: value must be a non-blank string.
  - `remember` boolean

## Response `2XX`

Successful response

- object
  - `body` object, required
    - `id` string, required: value must be a non-blank string.
    - `recovery_codes` string[], required
  - `cookies` object, required
  - `status` unknown, required

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/session/mfa/enroll/post.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)