---
title: "The step-up: pass the second factor for this sign-in session"
method: POST
path: "/api/me/mfa/verify"
tags: ["security"]
---

# The step-up: pass the second factor for this sign-in session

`POST /api/me/mfa/verify`

## Request

- Base URL: `https://api.wizbi.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.wizbi.ai/api/me/mfa/verify`
- Auth: none declared

## Request body

- union
  - object
    - `method` 'totp' | 'recovery', required
    - `code` string, required
  - object
    - `method` 'sms', required
    - `phoneIdToken` string, required

## Response `200`

OK.

- object
  - `satisfied` true, required

## Other responses

- `400`: Wrong code, or SMS while signed in with the phone (`mfa_sms_same_factor`).
- `403`: No factor enrolled.
- `429`: Locked after too many wrong codes.

---

[API](https://skmtc.dev/wizbi/apis/wizbi-core-api.md) · [All operations](https://skmtc.dev/wizbi/apis/wizbi-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wizbi/apis/wizbi-core-api/revisions/5a47416c82ec?raw)