API reference / Accounts

post/v1/token/mfa

Complete the second factor

Operation
completeMfa
Authentication
None — public

The password was correct. Kept separate from POST /v1/token so a wrong password and a wrong code are different events in the logs, and so the code can be rate limited far more tightly. A recovery code is accepted in place of a TOTP code and is consumed on use.

Request

Body

mfa_ticketstringrequired
codestringrequired

Responses

200A session.
access_tokenstring
refresh_tokenstring
token_typestring

one of: Bearer

expires_ininteger
mfa_requiredboolean
mfa_ticketstring
userobject
401The credentials were rejected. A wrong password, an unknown address and an expired ticket return an identical body on purpose: distinguishing them would let a caller discover which accounts exist.
errorobjectrequired
429Rate limit exceeded. Retry after `retry-after` seconds.
errorobjectrequired

Example

curl
curl -X POST https://api.haavisa.com/v1/token/mfa \
  -H "Content-Type: application/json" \
  -d '{
    "mfa_ticket": "<mfa_ticket>",
    "code": "<code>"
  }'

More in Accounts

Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.