Verify TOTP device
Checks that the TOTP sent in the body belongs to the totp device (specified by deviceName, belonging to the session user)
POST
/{apiBasePath}/totp/device/verifyAuthorization
AuthorizationBearer token · headerrequiredReturned as the "st-access-token" header from sign-in and refresh endpoints and present on requests that update the access token payload
or
sAccessTokenAPI key · cookierequiredThis is an HTTPOnly cookie, set by sign-in and refresh endpoints and present on requests that update the access token
Path parameters
apiBasePathstringrequiredIts value depends on the apiBasePath set by the user
Header parameters
ridstringThe TOTP recipe ID
anti-csrftokenThis will only be here if enabled by the user.
Request body
application/jsontotpstringdeviceNamestringResponses
200Verification result and optionally the session with a refreshed MFA claim
One of:
object
statusstatusOKSuccess status indicator
Allowed:
OKobject
statusstringAllowed:
UNKNOWN_DEVICE_ERRORobject
statusstringAllowed:
INVALID_TOTP_ERRORcurrentNumberOfFailedAttemptsnumbermaxNumberOfFailedAttemptsnumberobject
statusstringAllowed:
LIMIT_REACHED_ERRORretryAfterMsnumbergeneralErrorResponse
statusstringError status code
Allowed:
GENERAL_ERRORmessagestringError message
403A claim validation error happened during factor setup
One of:
object
messagestringError message
claimValidationErrorsobject[]List of claim validation errors
Show propertiesHide properties
Array of
objectidstringThe claim ID
reasonobjectThe reason for the validation error
object
messagestringError message
claimValidationErrorsobject[]List of claim validation errors
Show propertiesHide properties
Array of
objectidstringThe claim ID
reasonstringThe reason for the validation error
404Resource not found error
string500Internal server error
stringTry it
Server
Authorization
Parameters
Bodyapplication/json
Request
curl -X POST "/auth/totp/device/verify" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"totp": "123456",
"deviceName": "asdf123asdf"
}'const response = await fetch("/auth/totp/device/verify", {
method: "POST",
headers: {
"Authorization": "Bearer YOUR_TOKEN",
"Content-Type": "application/json"
},
body: JSON.stringify({
"totp": "123456",
"deviceName": "asdf123asdf"
})
});import requests
response = requests.post(
"/auth/totp/device/verify",
headers={
"Authorization": "Bearer YOUR_TOKEN",
"Content-Type": "application/json"
},
json={
"totp": "123456",
"deviceName": "asdf123asdf"
},
)Response
{
"status": "OK"
}{
"message": "invalid claim",
"claimValidationErrors": [
{
"id": "st-ev",
"reason": {
"message": "wrong value",
"expectedValue": true,
"actualValue": false
}
}
]
}"Not Found""Internal Error"