`POST /v1/control/mfa/enroll`: starts or restarts enrolment.

Available only to a session that has not yet satisfied its second factor, and refused outright once one is confirmed - otherwise anyone who walked past an unlocked screen could quietly replace the second factor with their own.

Errors

Returns 401 without a password-stage session, 409 once a second factor is already confirmed, and 503 when the enrolment store is unreachable.

POST /v1/control/mfa/enroll

`POST /v1/control/mfa/enroll`: starts or restarts enrolment.

cURL

curl --request POST \
  --url https://qa.esectra.com/v1/control/mfa/enroll \
  --cookie esectra_session=

200

{
  "otpauth_uri": "<string>",
  "secret": "<string>"
}

Authorizations

esectra_session · string · cookie · required

A signed-in reviewer's session. httpOnly and SameSite=Lax; set by POST /v1/control/sessions and only usable once the second factor is met.

Response

200

application/json

Enrolment secret and otpauth URI

The secret to put into an authenticator app.

otpauth_uri · string · required

The URI to render as a QR code.

secret · string · required

The same secret, for someone typing it in by hand.