POST /auth/mfa/enroll

Start TOTP enrollment. Requires a dashboard session.

An account can keep several authenticator apps, so this is also how you add another one later. Once the account already has one, adding another needs a session that has passed MFA — a token minted before the account had MFA is refused with 401 Unauthorized. Enrolling again before activating replaces the pending secret, so only one enrollment is ever in flight.

Response 200

{
  "provisioning_uri": "otpauth://totp/Seismic:alice@example.com?secret=…",
  "secret_base32": "JBSWY3DPEHPK3PXP"
}

Render provisioning_uri as a QR, or surface secret_base32 for manual entry. Then call mfa/activate with the first valid code. List what's already registered with GET /auth/mfa/authenticators.

Example

curl -X POST "$SEISMIC_ORCHESTRATION_URL/v0/auth/mfa/enroll" \
  -H "Authorization: Bearer $SEISMIC_DASHBOARD_TOKEN"