Start enabling TOTP two-factor authentication

POST 
/api/v1/auth/2fa/setup

Generates a TOTP secret for the caller (stored, not yet enabled) and returns it with a setupToken that /api/v1/auth/2fa/confirm requires. Adding a sign-in factor needs a re-authentication: currentPassword when the account has a password, otherwise a sign-in within the last 10 minutes. Every attempt spends the per-user change-password budget. Refused for personal access tokens and impersonation tokens.

Request

Responses

200

Pending TOTP secret

401

Not authenticated, or currentPassword is missing or wrong (error code INVALID_CURRENT_PASSWORD).

403

The account has no password and the session's sign-in is more than 10 minutes old (error code REAUTHENTICATION_REQUIRED), or the credential may not change sign-in factors.

409

Resource conflict

429

Too many requests