POST /v1/console/totp/verify


Call	`POST /v1/console/totp/verify`
Price	free
Scope	console session cookie (not an API key)
Operation id	`verifyTotp`

What it does

Check a current TOTP code. With a pending enrolment it turns TOTP on (audited as totp_enabled); when TOTP is already on it completes sign-in for this session. Either way the session is marked as having passed TOTP. A wrong code answers 401; attempts are rate limited. Session cookie required.

Example request

Copy it as curl. Set VERDICT_API_KEY first; uuidgen makes a fresh Idempotency-Key.

curl -X POST 'https://api.askverdict.io/v1/console/totp/verify' \
  --cookie "verdict_session=$VERDICT_SESSION" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/json' \
  -d '{
  "code": "123456"
}'

Example response

200: The code was accepted.

{
  "totp_enabled": true,
  "mfa_verified": true
}

Parameters

Name	In	Type	Required	Description
`idempotency-key`	header	string (uuid)	yes	A UUID you generate per logical request. Required on every POST. Repeating it within 24 hours returns the stored response and bills nothing; reusing it with a different body returns 409 `idempotency_conflict`.

Request body

Schema TotpCodeRequest. The code.

Field	Type	Required	Description
`code`	string	yes	The six-digit code from the authenticator app.

Response fields (200)

Schema TotpStatusResponse.

Field	Type	Required	Description
`totp_enabled`	boolean	yes	Whether TOTP is now on for the user.
`mfa_verified`	boolean	yes	Whether this session has now passed TOTP.

Errors

Errors are RFC 9457 problem details and are never billed. Branch on type. See Errors.

Status	Meaning
`400`	Invalid request: malformed JSON, an unknown field, a failed constraint or a size limit (`invalid_request`).
`401`	Missing, malformed, revoked or expired API key, or a bad webhook signature (`unauthorized`).
`404`	The resource does not exist in this organization (`not_found`).
`429`	Rate limited (`rate_limited`). Wait `Retry-After` seconds.
`500`	Unexpected server error (`internal`). Not billed; retry with the same `Idempotency-Key`.

Try it

Open the interactive reference to send this request from the browser. The full document is at /openapi.json.