---
title: "Verify MFA Factor"
method: POST
path: "/api/v1/users/{userId}/factors/{factorId}/verify"
tags: ["UserFactor"]
---

# Verify MFA Factor

`POST /api/v1/users/{userId}/factors/{factorId}/verify`

## Request

- Base URL: `https://your-subdomain.okta.com`
- URL: `https://your-subdomain.okta.com/api/v1/users/{userId}/factors/{factorId}/verify`
- Auth: API key in header `Authorization`

Verifies an OTP for a `token` or `token:hardware` factor

## Path parameters

- `userId` string, required
- `factorId` string, required

## Query parameters

- `templateId` string
- `tokenLifetimeSeconds` integer

## Headers

- `X-Forwarded-For` string
- `User-Agent` string
- `Accept-Language` string

## Request body

- VerifyFactorRequest
  - `activationToken` string
  - `answer` string
  - `attestation` string
  - `clientData` string
  - `nextPassCode` string
  - `passCode` string
  - `registrationData` string
  - `stateToken` string

## Response `200`

Success

- VerifyUserFactorResponse
  - `_embedded` object
  - `_links` object
  - `expiresAt` string, date-time
  - `factorResult` 'SUCCESS' | 'EXPIRED' | 'CHALLENGE' | 'WAITING' | 'FAILED' | 'REJECTED' | 'TIMEOUT' | 'TIME_WINDOW_EXCEEDED' | 'PASSCODE_REPLAYED' | 'ERROR'
  - `factorResultMessage` string

---

[API](https://skmtc.dev/okta/apis/okta-api.md) - [All operations](https://skmtc.dev/okta/apis/okta-api/llms.txt) - [OpenAPI document](https://skmtc.dev/okta/apis/okta-api/revisions/7e5249c30571?raw)