Admin Enable MFA

Enables a second factor on ANOTHER member’s account, and returns that member’s recovery codes.

{id} is the TARGET — the member being protected — not the administrator. The administrator is identified by the token.

This is the route for onboarding someone who cannot complete enrollment themselves, and it skips the three-step self-service flow entirely: there is no device to prove, so nothing is verified. That is why it is granted to administrative roles only.

⚠️ The response body IS the target member’s credential and is shown once. Hand it to them over a channel you trust.

Failures:

• 400 — the channel is unknown, or the target account lacks what it needs.
• 403 — your token does not hold the administrative MFA resource.
• 404 — no such user.
• 409 — that channel is already enabled for the target.
• 503 IDE-0066 — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.

POST /v1/users/{id}/mfa/admin/enable

Admin Enable MFA

cURL

curl --request POST \
  --url https://identity.sandbox.lerian.net/v1/users/{id}/mfa/admin/enable \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "mfaType": "email"
}
'

200

{
  "recoveryCodes": [
    "<string>"
  ]
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Path Parameters

id · string · required

Target User ID — the member whose MFA is being enabled, NOT the administrator.

Example:

"00000000-0000-0000-0000-000000000000"

Body

application/json

Which channel to enable on the target account.

mfaType · string · required

Example:

"email"

Response

200

application/json

OK

recoveryCodes · string[]