---
title: "Prepare a restricted authenticator proof"
method: POST
path: "/identity/factor_migrations/totp_enrollments"
tags: ["identity", "customer-session", "customer-session-public"]
---

# Prepare a restricted authenticator proof

`POST /identity/factor_migrations/totp_enrollments`

## Request

- Base URL: `https://api.stablesea.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stablesea.com/identity/factor_migrations/totp_enrollments`
- Auth: none declared

Creates a purpose-encrypted pending authenticator only when no verified authenticator exists. Requires migration_token; returns sensitive setup material without activating a factor or changing SMS.

## Request body

- IdentityMigrationInput
  - `migration_token` string, required

## Response `200`

OK

- IdentityMigrationTOTPOutput
  - `secret` string
  - `setup_token` string
  - `url` string

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `429`: Too Many Requests
- `503`: Service Unavailable
- `default`: Error response.

## Changes

- **2026-11-04** `fb17fc318db3`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/stablesea/apis/stable-sea-backend/changes/identity/factor_migrations/totp_enrollments/post.md)

---

[API](https://skmtc.dev/stablesea/apis/stable-sea-backend.md) - [All operations](https://skmtc.dev/stablesea/apis/stable-sea-backend/llms.txt) - [OpenAPI document](https://skmtc.dev/stablesea/apis/stable-sea-backend/revisions/fb17fc318db3?raw)