---
title: "Verifies an MFA token and code to complete authentication."
method: POST
path: "/api/auth/verify-mfa"
tags: ["Authentication"]
---

# Verifies an MFA token and code to complete authentication.

`POST /api/auth/verify-mfa`

## Response `200`

OK

- LoginResponse
  - `success` boolean
  - `error` string
  - `token` string
  - `mfaVerificationToken` string, uuid
  - `redirect` string
  - `appUser` AppUserCore
    - `audit` Audit
      - `createdTime` string, date-time
      - `modifiedTime` string, date-time
      - `modifiedBy` string
    - `appUserId` integer
    - `appId` integer
    - `membershipId` integer
    - `typeCode` 'APP_ADMIN' | 'MEMBERSHIP_ADMIN' | 'SUPER_ADMIN'
    - `email` string
    - `firstName` string
    - `lastName` string
    - `membershipPermissions` Permission[]
      - `action` 'MANAGE' | 'VIEW', required
      - `resource` 'BANNED_USERS' | 'CERTS' | 'CONTENTS' | 'COURSES' | 'EVALS' | 'EVENTS' | 'GROUPS' | 'MEMBERS' | 'NOTIFICATIONS' | 'ORGANIZATION' | 'PRODUCTS' | 'SELF_REPORTS' | 'SPONSORS' | 'TAGS' | 'TESTS', required
    - `disableTime` string, date-time
    - `mfaVerificationDisabled` boolean
    - `fullName` string
  - `userMembership` MemberFull
    - `audit` Audit
      - `createdTime` string, date-time
      - `modifiedTime` string, date-time
      - `modifiedBy` string
    - `userMembershipId` integer
    - `membershipId` integer
    - `username` string
    - `firstName` string
    - `middleName` string
    - `lastName` string
    - `email` string
    - `phone` string
    - `eventICalToken` string, uuid
    - `messagingToken` string, uuid
    - `isConfirmedMinAge13` boolean
    - `birthDate` string, date
    - `lockEndDate` string, date
    - `passwordModifiedTime` string, date-time
    - `idpPluginId` integer
    - `hasIncompleteProfile` boolean
    - `dependents` DependentFull[]
      - `audit` Audit
        - `createdTime` string, date-time
        - `modifiedTime` string, date-time
        - `modifiedBy` string
      - `userMembershipId` integer
      - `username` string
      - `guardianMemberIds` integer[]
      - `firstName` string
      - `middleName` string
      - `lastName` string
      - `eventICalToken` string, uuid
      - `messagingToken` string, uuid
      - `userProfileResponses` UserProfileResponseCore[]
        - `audit` Audit
          - `createdTime` string, date-time
          - `modifiedTime` string, date-time
          - `modifiedBy` string
        - `userProfileResponseId` integer
        - `profileQuestionId` integer
        - `userMembershipId` integer
        - `activitySubmissionId` integer
        - `evalId` integer
        - `eventRegistrationId` integer
        - `selfReportId` integer
        - `responses` string[]
        - `fileUuids` string[]
        - `responderComment` string
        - `imageUuids` string[]
        - `pointsEarned` number
      - `membershipNumber` string
      - `fullName` string
      - `isPrimary` boolean
    - `userProfileResponses` UserProfileResponseCore[]
      - `audit` Audit
        - `createdTime` string, date-time
        - `modifiedTime` string, date-time
        - `modifiedBy` string
      - `userProfileResponseId` integer
      - `profileQuestionId` integer
      - `userMembershipId` integer
      - `activitySubmissionId` integer
      - `evalId` integer
      - `eventRegistrationId` integer
      - `selfReportId` integer
      - `responses` string[]
      - `fileUuids` string[]
      - `responderComment` string
      - `imageUuids` string[]
      - `pointsEarned` number
    - `membershipNumber` string
    - `fullName` string
    - `isPrimary` boolean
    - `isLocked` boolean
  - `event` EventSlim
    - `audit` Audit
      - `createdTime` string, date-time
      - `modifiedTime` string, date-time
      - `modifiedBy` string
    - `alternateLocales` object
      - `empty` boolean
    - `eventId` integer
    - `membershipId` integer
    - `attendanceTypeCode` 'IN_PERSON' | 'VIRTUAL'
    - `registrationTypeCode` 'OPEN' | 'REGISTRATION' | 'REGISTRATION_WITH_RSVP' | 'TICKETED'
    - `eventSeries` EventSeriesFull
      - `audit` Audit
        - `createdTime` string, date-time
        - `modifiedTime` string, date-time
        - `modifiedBy` string
      - `eventSeriesId` integer
      - `period` 'DAILY' | 'WEEKLY'
      - `stepSize` integer
      - `endDate` string, date
      - `endCount` integer
    - `title` string
    - `description` string
    - `body` string
    - `externalBody` string
    - `location` string
    - `startDateTime` string, date-time
    - `endDateTime` string, date-time
    - `registrationOpenDateTime` string, date-time
    - `registrationCloseDateTime` string, date-time
    - `timeZoneId` string
    - `allDay` boolean
    - `credits` number
    - `published` boolean
    - `unlisted` boolean
    - `allowViewRegistrations` boolean
    - `registrationTicketingEnabled` boolean
    - `dependentRegistrationEnabled` boolean
    - `cancelled` boolean
    - `external` boolean
    - `imageUuid` string, uuid
    - `contactLabel` string
    - `contactUrl` string
    - `audienceId` integer
    - `audiencePromo` AudiencePromo
      - `contentId` integer
      - `actionText` string
      - `localizedValues` AudiencePromoLocaleValues
        - `actionText` string
    - `reminder1Minutes` integer
    - `reminder2Minutes` integer
    - `emailRemindersEnabled` boolean
    - `registrationsMax` integer
    - `registrationsMaxWarningThreshold` integer
    - `previewing` boolean
    - `locale` string
  - `expires` string, date-time

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `500` — Internal server error

---

[API](https://skmtc.dev/mobilecoach/apis/untitled-api.md) · [All operations](https://skmtc.dev/mobilecoach/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mobilecoach/untitled-api/revisions/f2568e11c0ab/schema)