Start enrolling a required MFA factor

curl --request POST \
  --url https://auth.sandbox.lerian.net/v1/login/mfa/setup \
  --header 'Content-Type: application/json' \
  --data '
{
  "mfaToken": "eyJhbGciOiJIUzI1NiJ9...",
  "mfaType": "app"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.sandbox.lerian.net/v1/login/mfa/setup"

	payload := strings.NewReader("{\n  \"mfaToken\": \"eyJhbGciOiJIUzI1NiJ9...\",\n  \"mfaType\": \"app\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({mfaToken: 'eyJhbGciOiJIUzI1NiJ9...', mfaType: 'app'})
};

fetch('https://auth.sandbox.lerian.net/v1/login/mfa/setup', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://auth.sandbox.lerian.net/v1/login/mfa/setup"

payload = {
    "mfaToken": "eyJhbGciOiJIUzI1NiJ9...",
    "mfaType": "app"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "mfaType": "app",
  "recoveryCodes": [
    "<string>"
  ],
  "secret": "JBSWY3DPEHPK3PXP",
  "url": "otpauth://totp/Lerian:ana?secret=JBSWY3DPEHPK3PXP"
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Start enrolling a required MFA factor

Starts the enrollment of the factor an organization requires, for a login refused with 401 AUT-0019. Public: authenticated by the enrollment-only mfaToken of that refusal. For an authenticator app the answer carries the secret and the otpauth URL; for an email the code is sent to the account’s own address. The recovery code is shown once. The server keeps the secret, so confirm sends only the passcode. A challenge token is not an enrollment token (AUT-0017).

POST

mfa

setup

curl --request POST \
  --url https://auth.sandbox.lerian.net/v1/login/mfa/setup \
  --header 'Content-Type: application/json' \
  --data '
{
  "mfaToken": "eyJhbGciOiJIUzI1NiJ9...",
  "mfaType": "app"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.sandbox.lerian.net/v1/login/mfa/setup"

	payload := strings.NewReader("{\n  \"mfaToken\": \"eyJhbGciOiJIUzI1NiJ9...\",\n  \"mfaType\": \"app\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({mfaToken: 'eyJhbGciOiJIUzI1NiJ9...', mfaType: 'app'})
};

fetch('https://auth.sandbox.lerian.net/v1/login/mfa/setup', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://auth.sandbox.lerian.net/v1/login/mfa/setup"

payload = {
    "mfaToken": "eyJhbGciOiJIUzI1NiJ9...",
    "mfaType": "app"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "mfaType": "app",
  "recoveryCodes": [
    "<string>"
  ],
  "secret": "JBSWY3DPEHPK3PXP",
  "url": "otpauth://totp/Lerian:ana?secret=JBSWY3DPEHPK3PXP"
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Body

application/json

mfaToken

string

required

The enrollment-only token of a 401 AUT-0019 refusal.

Example:

"eyJhbGciOiJIUzI1NiJ9..."

mfaType

enum<string>

required

The factor to enroll: one of the availableMethods of the AUT-0019 refusal.

Available options:

app,

email

Example:

"app"

Response

mfaType

string

required

Example:

"app"

recoveryCodes

string[] | null

required

The recovery code to show once and ask the person to keep.

secret

string

The authenticator secret for manual entry. App only.

Example:

"JBSWY3DPEHPK3PXP"

url

string

The otpauth URI to render as a QR code. App only.

Example:

"otpauth://totp/Lerian:ana?secret=JBSWY3DPEHPK3PXP"

Overview

Authentication

Single sign-on

Authorization

User information

Login MFA

Login passkey

Identity overview

Groups

Applications

Partners

Users

Account MFA

Account passkey

Identity providers

Application providers

Permissions

Roles

Security policies

Plugin declarations

Error handling

Start enrolling a required MFA factor

Body

Response