---
title: "MFA Assertion Options"
method: POST
path: "/v1/auth/mfa/options"
tags: ["Auth: MFA"]
---

# MFA Assertion Options

`POST /v1/auth/mfa/options`

## Request

- Base URL: `https://api.robosystems.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.robosystems.ai/v1/auth/mfa/options`
- Auth: none declared

Exchange an mfa_required login token for passkey assertion options.

## Request body

- MfaOptionsRequest: Request assertion options for the second factor.
  - `mfa_token` string, required: Token from a login that returned mfa_required

## Response `200`

Successful Response

- CeremonyOptionsResponse: WebAuthn options for the browser, verbatim from the RP library.
  - `options` object, required: PublicKeyCredential options (browser JSON, opaque)

## Other responses

- `400`: Invalid request
- `401`: Invalid or expired MFA token
- `422`: Validation Error
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/robosystems/apis/robosystems-api.md) · [All operations](https://skmtc.dev/robosystems/apis/robosystems-api/llms.txt) · [OpenAPI document](https://skmtc.dev/robosystems/apis/robosystems-api/revisions/e661e2d5ca6a?raw)