Complete a pending login with a code or recovery code

POST

/v1/auth/totp/challenge

curl --request POST \
  --url https://example.com/v1/auth/totp/challenge \
  --header 'Content-Type: application/json' \
  --data '{ "code": "example", "mfa_token": "example", "recovery_code": "example" }'

• this engine

Completes a primary-verified pending login with an authenticator code or a single-use recovery code. Wrong codes are throttled; successful proof and session issuance are transactional.

Authorizations

• None

Request Body ^required

Media type application/json

Any of:

object

object

code

required

string

mfa_token

string

recovery_code

string

object

object

code

string

mfa_token

string

recovery_code

required

string

Example ^generated

{
  "code": "example",
  "mfa_token": "example",
  "recovery_code": "example"
}

Responses

200

OK

Media type application/json

One of:

object

object

expires_at

required

string format: date-time

session_id

required

string format: uuid

token

required

Opaque session token (olvs_…)

string

object

object

csrf_token

required

string

expires_at

required

string format: date-time

session_id

required

string format: uuid

Example ^generated

{
  "expires_at": "2026-04-15T12:00:00Z",
  "session_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "token": "example"
}

400

Request refused

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

401

Request refused

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

403

Request refused

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

404

Request refused

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

409

Request refused

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

429

Request refused

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

503

Request refused

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}