Turn two-factor on
POST/admin/auth/totp/activate
Confirms the enrolment with a code from the authenticator, and answers with the recovery codes.
The codes are shown once. Only their SHA-256 is stored, so a client that does not display them here has lost them — there is no route that reads them back, only one that replaces the set.
Request
Responses
- 200
- 400
- 401
- 403
- 409
Two-factor active — the codes are shown once
Malformed body, or code missing
invalid_code — wrong or replayed
account_suspended
Nothing to activate (no enrolment started), or two-factor is already on