Finish TOTP enrolment

The secret is sealed with AES-256-GCM under a versioned KEK, and the step the enrolling code used is recorded with it, so replaying that same code cannot also open a session.

Authorization

consoleSession

__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

secret*string

Match^[A-Z2-7]{16,128}$

code*string

Match^[0-9]{6}$

Response Body

`application/json`

curl -X POST "https://example.com/console/v1/mfa" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "secret": "string",    "code": "string"  }'

Empty

Finish TOTP enrolment

Authorization

Request Body

Response Body

204

400application/json

401application/json

403application/json

404application/json

405application/json

413application/json

415application/json

422application/json

500application/json

503application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`