Begin TOTP enrolment
POST/admin/auth/totp/enroll
Returns the shared secret and its otpauth:// URI — a QR code's worth of
data, not an image. The client renders the code from this string.
Two-factor stays off until it is activated. Enabling it here would lock out anyone who scanned the code into an authenticator that does not work.
Re-enrolling while two-factor is already on is refused: it would replace a working secret in one request, so resetting an authenticator has to go through disabling first, which costs a password.
Responses
- 200
- 401
- 403
- 409
Pairing material — not active yet
No session cookie, or it expired
account_suspended
Two-factor is already enabled — disable it first