POST /auth/mfa/verify

Redeem a challenge_id (from login) + TOTP code for a token pair.

An account may have several authenticator apps registered. A code from any of them satisfies the challenge — the user picks whichever app is to hand.

Request

{
  "challenge_id": "mfa_b4bd0c1d8e2f4a6b9d3c",
  "code": "123456"
}

Response 200: TokenPair.

Errors: 401 (wrong code, expired challenge, clock skew).

Example

curl -X POST "$SEISMIC_ORCHESTRATION_URL/v0/auth/mfa/verify" \
  -H "content-type: application/json" \
  -d '{
    "challenge_id": "mfa_b4bd0c1d8e2f4a6b9d3c",
    "code": "123456"
  }'