> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Initiate an MFA challenge

> Use this endpoint with `mfaType: email` to request a new verification code sent via email. The API also accepts `app`, but it does not send a code for that method: authenticator apps generate passcodes locally. Clients using an authenticator app can proceed directly to verification.

Requires a valid `mfaToken` obtained from the access token endpoint.



## OpenAPI

````yaml /pt/openapi/v3-current/AM-auth.yaml post /v1/login/mfa/challenge
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager auth component.
  license:
    name: Lerian Studio General License
  title: Access Manager Auth API
  version: v1
servers:
  - url: https://auth.sandbox.lerian.net
security: []
tags:
  - description: >-
      OAuth2 token issuance: request an access token, refresh it, and log out.
      Public issuer endpoints.
    name: OAuth
  - description: >-
      Single sign-on through the tenant's identity provider: discover how an
      email signs in, then start the login. Public, called by the browser before
      login.
    name: SSO
  - description: >-
      Multi-factor authentication challenge and verification during the login
      flow. Public (identity is carried by the MFA token, not a Bearer token).
    name: MFA
  - description: >-
      Token-secured routes: enforce a permission, list the caller's permissions,
      and fetch OIDC user info. Require a Bearer token, validated in the use
      case.
    name: User Permission
paths:
  /v1/login/mfa/challenge:
    post:
      tags:
        - MFA
      summary: Initiate an MFA challenge
      description: >-
        Use this endpoint with `mfaType: email` to request a new verification
        code sent via email. The API also accepts `app`, but it does not send a
        code for that method: authenticator apps generate passcodes locally.
        Clients using an authenticator app can proceed directly to verification.


        Requires a valid `mfaToken` obtained from the access token endpoint.
      operationId: initiateMFAChallenge
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MFAChallengeInput'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MFAChallengeInitiatedResponse'
          description: >-
            The challenge request succeeded. For email, a verification code was
            sent. For app, no code is sent.
        '422':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Service Unavailable
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Error
components:
  schemas:
    MFAChallengeInput:
      additionalProperties: false
      properties:
        mfaToken:
          description: Short-lived MFA session token issued when a login requires MFA.
          examples:
            - eyJhbGciOiJIUzI1NiJ9...
          type: string
        mfaType:
          description: >-
            Use email to send a verification code. The app value is accepted but
            does not send a code; authenticator apps generate passcodes locally.
          enum:
            - app
            - email
          examples:
            - app
          type: string
      required:
        - mfaToken
        - mfaType
      type: object
    MFAChallengeInitiatedResponse:
      additionalProperties: false
      properties:
        message:
          description: Human-readable acknowledgement that the challenge was dispatched.
          examples:
            - MFA challenge initiated
          type: string
      required:
        - message
      type: object
    Detail:
      additionalProperties: true
      properties:
        code:
          description: >-
            Stable, machine-readable domain error code scoped to the emitting
            service (format: <SERVICE>-NNNN).
          type: string
        detail:
          description: >-
            A human-readable explanation specific to this occurrence of the
            problem.
          examples:
            - Property foo is required but is missing.
          type: string
        errors:
          description: Optional list of individual error details
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type:
            - array
            - 'null'
        instance:
          description: >-
            A URI reference that identifies the specific occurrence of the
            problem.
          examples:
            - https://example.com/error-log/abc123
          format: uri
          type: string
        status:
          description: HTTP status code
          examples:
            - 400
          format: int64
          type: integer
        title:
          description: >-
            A short, human-readable summary of the problem type. This value
            should not change between occurrences of the error.
          examples:
            - Bad Request
          type: string
        type:
          default: about:blank
          description: A URI reference to human-readable documentation for the error.
          examples:
            - https://example.com/errors/example
          format: uri
          type: string
        upstream:
          $ref: '#/components/schemas/Upstream'
          description: >-
            RFC 9457 extension member: the error a proxied third-party provider
            reported. Absent unless the emitting service explicitly surfaced
            one.
      type: object
    ErrorDetail:
      additionalProperties: false
      properties:
        location:
          description: >-
            Where the error occurred, e.g. 'body.items[3].tags' or
            'path.thing-id'
          type: string
        message:
          description: Error message text
          type: string
        value:
          description: The value at the given location
      type: object
    Upstream:
      additionalProperties: false
      properties:
        code:
          description: The upstream provider's own error code, verbatim.
          examples:
            - E4001
          type: string
        message:
          description: >-
            The upstream provider's own error message, verbatim (bounded, never
            its raw response body).
          examples:
            - account not found at provider
          type: string
      type: object

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.