Keys

Turn on two-step sign-in

Checks the first code from the app being set up and turns two-step sign-in on.

POST/user/two-factor/enable

TL;DR

Question	Answer
What does it do?	Turn on two-step sign-in.
What does it take?	A JSON body of type `TotpCodeBody`.
What does it return?	Status 200 with a body of type `RecoveryCodes`.
What can go wrong?	`400` the body is not valid; `401` not signed in, or the code is wrong (`auth.two_factor_invalid`); `403` the request came from an origin that may not make changes; `409` it is already on (`account.two_factor_on`), or setup was not started (`account.two_factor_off`); `429` too many requests. Every failure uses the one error envelope.

Checks the first code from the app being set up and turns two-step sign-in on. Answers ten recovery codes, shown once. Every other session ends.

The body has the type TotpCodeBody.

Field	Type	Required	Description
`code`	`string`	yes	The six digits the authenticator app shows now. pattern `^\d{6}$`.

Status	Meaning	Body
200	On, with the recovery codes.	`RecoveryCodes`
400	The body is not valid.	`ErrorResponse`
401	Not signed in, or the code is wrong (`auth.two_factor_invalid`).	`ErrorResponse`
403	The request came from an origin that may not make changes.	`ErrorResponse`
409	It is already on (`account.two_factor_on`), or setup was not started (`account.two_factor_off`).	`ErrorResponse`
429	Too many requests.	`ErrorResponse`

A 200 answer has the type RecoveryCodes.

Field	Type	Required	Description
`recoveryCodes`	`string[]`	yes

Doc	Why
API reference	Every endpoint, and the error envelope
Schemas	Every request and response type
Tool reference	The operations as callable tools