---
title: "Elevate access for an already signed in user using TOTP MFA"
method: POST
path: "/elevate/totp"
tags: ["security"]
---

# Elevate access for an already signed in user using TOTP MFA

`POST /elevate/totp`

## Request

- Base URL: `https://{subdomain}.auth.{region}.nhost.run/v1`
- URL: `https://{subdomain}.auth.{region}.nhost.run/v1/elevate/totp`
- Auth: HTTP bearer

Verify a TOTP code to elevate the permissions of an already signed in user

## Request body

- ElevateTotpRequest
  - `otp` string, required: One time password

## Response `200`

Elevated successfully

- SessionPayload: Container for session information
  - `session` Session: User authentication session containing tokens and user information
    - `accessToken` string, required: JWT token for authenticating API requests
    - `accessTokenExpiresIn` integer, required: Expiration time of the access token in seconds
    - `refreshTokenId` string, required: Identifier for the refresh token
    - `refreshToken` string, required: Token used to refresh the access token
    - `user` User: User profile and account information
      - `avatarUrl` string, required: URL to the user's profile picture
      - `createdAt` string, date-time, required: Timestamp when the user account was created
      - `defaultRole` string, required: Default authorization role for the user
      - `displayName` string, required: User's display name
      - `email` string, email: User's email address
      - `emailVerified` boolean, required: Whether the user's email has been verified
      - `id` string, required: Unique identifier for the user
      - `isAnonymous` boolean, required: Whether this is an anonymous user account
      - `locale` string, required: User's preferred locale (language code)
      - `metadata` object, nullable, required: Custom metadata associated with the user
      - `phoneNumber` string: User's phone number
      - `phoneNumberVerified` boolean, required: Whether the user's phone number has been verified
      - `roles` string[], required: List of roles assigned to the user
      - `activeMfaType` string, nullable: Active MFA type for the user

## Other responses

- `default`: An error occurred while processing the request

## Changes

- **2026-10-19** `57c5149be66f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nhost/apis/nhost-authentication-api/changes/elevate/totp/post.md)

---

[API](https://skmtc.dev/nhost/apis/nhost-authentication-api.md) - [All operations](https://skmtc.dev/nhost/apis/nhost-authentication-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nhost/apis/nhost-authentication-api/revisions/ba714d949d74?raw)