PHphilterd
Users

Start MFA enrollment.

Changed on

Generates a TOTP secret for the calling key's own user and returns it, with an otpauth:// URI to show as a QR code. The secret is returned only here and is encrypted at rest. Enrollment takes effect only once POST /api/users/me/mfa/confirm sees a valid code; starting again replaces an unconfirmed secret. Takes the user's current password, so a stolen key cannot enroll an authenticator of its own; a wrong password counts toward the sign-in lockout. Requires the mfaAvailable setting, and the scope but not an administrator. Requires the users:write scope.

post/api/users/me/mfa

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /api/users/me/mfa
  • Auth
    HTTP bearer

Headers

Authorizationstring required

Request body

passwordstring

Response

The secret to set up an authenticator app with.

otpauthUristring

The otpauth:// URI to show as a QR code for an authenticator app to scan.

secretstring

The setup key, Base32, for entering by hand. Returned only here.

Changes