---
title: "Attempt multi-factor authentication."
method: POST
path: "/mfa/verify/{mfaProviderName}.json"
tags: ["Multi-Factor Authentication"]
---

# Attempt multi-factor authentication.

`POST /mfa/verify/{mfaProviderName}.json`

## Request

- Base URL: `https://passbolt.local`
- URL: `https://passbolt.local/mfa/verify/{mfaProviderName}.json`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/passbolt/apis/passbolt-api/docs/mfa/verify/:mfaProviderName.json/post.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `mfaProviderName` 'totp' | 'yubikey' | 'duo', required

## Request body

- union
  - object
    - `totp` string, required: One-time code for TOTP-based MFA.
    - `remember` 0 | 1
  - object
    - `hotp` string, required: One-time code for Yubikey-based MFA.
    - `remember` 0 | 1

## Response `200`

Operation is successful.

- object
  - `header` Header, required
    - `id` string, uuid, required
    - `status` 'success' | 'error', required
    - `servertime` integer, required
    - `action` string, uuid, required
    - `message` string, required
    - `url` string, uri, required
    - `code` integer, required
  - `body` unknown, required

## Other responses

- `400`: Invalid OTP code.
- `401`: Authentication required.

## Changes

- **2026-11-06** `8d72215e2274`: 1 info
  - added the new enum value `duo` to the `path` request parameter `mfaProviderName`

[Operation history](https://skmtc.dev/passbolt/apis/passbolt-api/changes/mfa/verify/:mfaProviderName.json/post.md)

---

[API](https://skmtc.dev/passbolt/apis/passbolt-api.md) - [All operations](https://skmtc.dev/passbolt/apis/passbolt-api/llms.txt) - [OpenAPI document](https://skmtc.dev/passbolt/apis/passbolt-api/revisions/8d72215e2274?raw)