Fac-360
Identity

Remove the second factor

DELETE
/console/v1/mfa

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/console/v1/mfa" \  -H "Authorization: Bearer apf_v2_tu_credencial"
Empty

Finish TOTP enrolment POST POST

The secret is sealed with AES-256-GCM under a versioned KEK, and the step the enrolling code used is recorded with it, so replaying that same code cannot also open a session.

The companies this session can operate GET GET

A listing, not an authorisation: it resolves membership across organizations and binds nothing. Selecting one is GET /console/v1/companies/{companyId}, which is where the membership check and the assignment of app.tenant_id happen as one act.