---
title: "Complete TOTP enrollment (business)"
method: POST
path: "/business/resume/setup-two-factor"
tags: ["Business Enrollment"]
---

# Complete TOTP enrollment (business)

`POST /business/resume/setup-two-factor`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/business/resume/setup-two-factor`
- Auth: API key in header `api-key` and API key in header `Authorization`

Confirms the secret returned by `/business/start/setup-two-factor` by submitting the current 6-digit code from the authenticator app. Returns the one-time recovery codes — show them to the operator once.

## Request body

- object
  - `businessId` string, uuid, required
  - `secret` string, required: Secret returned by `/business/start/setup-two-factor`.
  - `code` string, required

## Response `200`

TOTP is now enrolled. Recovery codes returned once.

- object
  - `recoveryCodes` string[]: One-time recovery codes.

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)