---
title: "Verify Totp"
method: POST
path: "/auth/mfa/verify/totp"
tags: ["Auth"]
---

# Verify Totp

`POST /auth/mfa/verify/totp`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/auth/mfa/verify/totp`
- Auth: HTTP bearer

Confirm enrolment by submitting an OTP from the freshly-installed
authenticator.

On success:
- Flip the method to ``is_active=True``.
- First-time-only: mint a fresh batch of recovery codes (returned
  exactly once) and stamp ``users.mfa_enforced_at``.
- Mint a fresh access token with ``mfa_satisfied=true,
  mfa_recovery=false`` — this is what unlocks a recovery-locked
  session.

## Headers

- `API-Version` '1'

## Request body

- TotpVerifyRequest: POST body for /auth/mfa/verify/totp.
  - `method_id` integer, required
  - `code` string, required

## Response `200`

Successful Response

- TotpVerifyResponse: Body returned by /auth/mfa/verify/totp. On a successful verification we also issue a fresh access token — this is what flips the user out of a recovery-locked session and into a full one once they've re-enrolled.
  - `method_id` integer, required
  - `access_token` string, required
  - `recovery_codes` string[], nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/totalparks/apis/total-parks-public-api.md) · [All operations](https://skmtc.dev/totalparks/apis/total-parks-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/totalparks/apis/total-parks-public-api/revisions/dcb4c822e2c6?raw)