---
title: "Verifies an MFA token and code to complete authentication."
method: POST
path: "/api/auth/verify-mfa"
tags: ["Authentication"]
---

# Verifies an MFA token and code to complete authentication.

`POST /api/auth/verify-mfa`

## Request

- Base URL: `https://api.mobilecoach.org` (the document declares no server; this is the origin it was published from)
- URL: `https://api.mobilecoach.org/api/auth/verify-mfa`
- Auth: none declared

## Request body `*/*`

- MfaVerificationRequest
  - `code` string, required
  - `token` string, uuid, required

## Response `200`

OK

- LoginResponse
  - `success` boolean
  - `error` string
  - `token` string
  - `mfaVerificationToken` string, uuid
  - `redirect` string
  - `appUser` AppUserCore
    - `audit` Audit
      - `createdTime` string, date-time
      - `modifiedTime` string, date-time
      - `modifiedBy` string
    - `appUserId` integer
    - `appId` integer
    - `membershipId` integer
    - `typeCode` 'APP_ADMIN' | 'MEMBERSHIP_ADMIN' | 'SUPER_ADMIN'
    - `email` string
    - `firstName` string
    - `lastName` string
    - `membershipPermissions` Permission[]
      - `action` 'MANAGE' | 'VIEW', required
      - `resource` 'BANNED_USERS' | 'CERTS' | 'CONTENTS' | 'COURSES' | 'EVALS' | 'EVENTS' | 'GROUPS' | 'MEMBERS' | 'NOTIFICATIONS' | 'ORGANIZATION' | 'PRODUCTS' | 'SELF_REPORTS' | 'SPONSORS' | 'TAGS' | 'TESTS', required
    - `disableTime` string, date-time
    - `mfaVerificationDisabled` boolean
    - `fullName` string
  - `partnerUser` PartnerUserFull
    - `audit` Audit
      - `createdTime` string, date-time
      - `modifiedTime` string, date-time
      - `modifiedBy` string
    - `partnerUserId` integer
    - `username` string
    - `appId` integer
    - `membershipId` integer
    - `permissions` Permission[]
      - `action` 'MANAGE' | 'VIEW', required
      - `resource` 'BANNED_USERS' | 'CERTS' | 'CONTENTS' | 'COURSES' | 'EVALS' | 'EVENTS' | 'GROUPS' | 'MEMBERS' | 'NOTIFICATIONS' | 'ORGANIZATION' | 'PRODUCTS' | 'SELF_REPORTS' | 'SPONSORS' | 'TAGS' | 'TESTS', required
    - `contactName` string
    - `contactEmail` string
    - `group` GroupCore
      - `audit` Audit
        - `createdTime` string, date-time
        - `modifiedTime` string, date-time
        - `modifiedBy` string
      - `groupId` integer
      - `groupType` GroupTypeCore
        - `audit` Audit
          - `createdTime` string, date-time
          - `modifiedTime` string, date-time
          - `modifiedBy` string
        - `groupTypeId` integer
        - `membershipId` integer
        - `name` string
        - `namePlural` string
        - `description` string
        - `properties` GroupTypeProperties
          - `announcementsHtml` string
          - `chatEnabled` boolean
          - `chatDefaultEnabled` boolean
          - `contactSharingDefaultEnabled` boolean
          - `postsEnabled` boolean
          - `postsDefaultEnabled` boolean
        - `root` boolean
        - `external` boolean
        - `externalReferenceId` string
        - `isPrivate` boolean
      - `membershipId` integer
      - `name` string
      - `properties` GroupProperties
        - `chatEnabled` boolean
        - `postsEnabled` boolean
      - `nodeActive` boolean
      - `ancestryActive` boolean
      - `active` boolean
      - `root` boolean
      - `external` boolean
      - `externalReferenceId` string
  - `userMembership` MemberFull
    - `audit` Audit
      - `createdTime` string, date-time
      - `modifiedTime` string, date-time
      - `modifiedBy` string
    - `userMembershipId` integer
    - `membershipId` integer
    - `username` string
    - `firstName` string
    - `middleName` string
    - `lastName` string
    - `email` string
    - `phone` string
    - `eventICalToken` string, uuid
    - `messagingToken` string, uuid
    - `isConfirmedMinAge13` boolean
    - `birthDate` string, date
    - `lockEndDate` string, date
    - `passwordModifiedTime` string, date-time
    - `idpPluginId` integer
    - `hasIncompleteProfile` boolean
    - `dependents` DependentFull[]
      - `audit` Audit
        - `createdTime` string, date-time
        - `modifiedTime` string, date-time
        - `modifiedBy` string
      - `userMembershipId` integer
      - `username` string
      - `guardianMemberIds` integer[]
      - `firstName` string
      - `middleName` string
      - `lastName` string
      - `eventICalToken` string, uuid
      - `messagingToken` string, uuid
      - `userProfileResponses` UserProfileResponseCore[]
        - `audit` Audit
          - `createdTime` string, date-time
          - `modifiedTime` string, date-time
          - `modifiedBy` string
        - `userProfileResponseId` integer
        - `profileQuestionId` integer
        - `userMembershipId` integer
        - `activitySubmissionId` integer
        - `evalId` integer
        - `eventRegistrationId` integer
        - `selfReportId` integer
        - `responses` string[]
        - `fileUuids` string[]
        - `responderComment` string
        - `imageUuids` string[]
        - `pointsEarned` number
      - `membershipNumber` string
      - `fullName` string
      - `isPrimary` boolean
    - `userProfileResponses` UserProfileResponseCore[]
      - `audit` Audit
        - `createdTime` string, date-time
        - `modifiedTime` string, date-time
        - `modifiedBy` string
      - `userProfileResponseId` integer
      - `profileQuestionId` integer
      - `userMembershipId` integer
      - `activitySubmissionId` integer
      - `evalId` integer
      - `eventRegistrationId` integer
      - `selfReportId` integer
      - `responses` string[]
      - `fileUuids` string[]
      - `responderComment` string
      - `imageUuids` string[]
      - `pointsEarned` number
    - `membershipNumber` string
    - `fullName` string
    - `isPrimary` boolean
    - `isLocked` boolean
  - `event` EventSlim
    - `audit` Audit
      - `createdTime` string, date-time
      - `modifiedTime` string, date-time
      - `modifiedBy` string
    - `alternateLocales` object
      - `empty` boolean
    - `eventId` integer
    - `membershipId` integer
    - `attendanceTypeCode` 'IN_PERSON' | 'VIRTUAL'
    - `registrationTypeCode` 'OPEN' | 'REGISTRATION' | 'REGISTRATION_WITH_RSVP' | 'TICKETED'
    - `eventSeries` EventSeriesFull
      - `audit` Audit
        - `createdTime` string, date-time
        - `modifiedTime` string, date-time
        - `modifiedBy` string
      - `eventSeriesId` integer
      - `period` 'DAILY' | 'WEEKLY'
      - `stepSize` integer
      - `endDate` string, date
      - `endCount` integer
    - `title` string
    - `description` string
    - `body` string
    - `externalBody` string
    - `location` string
    - `startDateTime` string, date-time
    - `endDateTime` string, date-time
    - `registrationOpenDateTime` string, date-time
    - `registrationCloseDateTime` string, date-time
    - `timeZoneId` string
    - `allDay` boolean
    - `credits` number
    - `published` boolean
    - `unlisted` boolean
    - `allowViewRegistrations` boolean
    - `registrationTicketingEnabled` boolean
    - `dependentRegistrationEnabled` boolean
    - `cancelled` boolean
    - `external` boolean
    - `imageUuid` string, uuid
    - `contactLabel` string
    - `contactUrl` string
    - `audienceId` integer
    - `audiencePromo` AudiencePromo
      - `contentId` integer
      - `actionText` string
      - `localizedValues` AudiencePromoLocaleValues
        - `actionText` string
    - `reminder1Minutes` integer
    - `reminder2Minutes` integer
    - `emailRemindersEnabled` boolean
    - `registrationsMax` integer
    - `registrationsMaxWarningThreshold` integer
    - `previewing` boolean
    - `locale` string
  - `expires` string, date-time

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `500`: Internal server error

## Changes

- **2026-10-09** `f08e033be1fd`: 1 info
  - added the optional property `partnerUser` to the response with the `200` status
- **2026-09-02** `870f28ba2607`: 5 info
  - added the optional property `error/errorId` to the response with the `400` status
  - added the optional property `error/errorId` to the response with the `401` status
  - added the optional property `error/errorId` to the response with the `403` status
  - added the optional property `error/errorId` to the response with the `404` status
  - …1 more

[Operation history](https://skmtc.dev/mobilecoach/apis/mobilecoach-api/changes/api/auth/verify-mfa/post.md)

---

[API](https://skmtc.dev/mobilecoach/apis/mobilecoach-api.md) - [All operations](https://skmtc.dev/mobilecoach/apis/mobilecoach-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mobilecoach/apis/mobilecoach-api/revisions/df463b248fcb?raw)