API reference / Accounts
post
/v2/accounts/mfa/enrollBegin two-factor enrolment
- Operation
enrollMfa- Authentication
- None — public
The secret is returned once and is NOT active until a code has been verified, so a user who abandons enrolment is not locked out of an account protected by a secret they never saved.
Request
Responses
200A secret and its provisioning URI.
secretstringrequiredprovisioning_uristringrequiredwarningstringrequired400The request body or query failed validation.
errorobjectrequired401No key, an unknown key, a revoked key, or a key whose tenant is not active. All four return an identical body on purpose: distinguishing them would let a caller discover which partners we have.
errorobjectrequired403The key is valid but does not hold the scope this route requires.
errorobjectrequired404Not found, or not yours. A resource belonging to another tenant answers 404 rather than 403, because 403 would confirm the record exists.
errorobjectrequiredExample
curl -X POST https://api.haavisa.com/v2/accounts/mfa/enrollMore in Accounts
POST/v1/tokenGET/v1/token/introspectPOST/v1/token/mfaPOST/v1/token/revokePOST/v2/accountsGET/v2/accounts/mePATCH/v2/accounts/meGET/v2/accounts/me/messaging-consentPUT/v2/accounts/me/messaging-consentPOST/v2/accounts/mfa/activatePOST/v2/accounts/mfa/disablePOST/v2/accounts/password-resetPOST/v2/accounts/password-reset/confirmPOST/v2/accounts/sign-inPOST/v2/accounts/sign-outPOST/v2/accounts/verify-emailPOST/v2/accounts/verify-email/resend
Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.