Mfa

Generated from Huudis's own code: every route in this area, what it takes and how to call it.

Method	Path	What it does
GET	/api/v1/mfa/challenge	Read-only — lets the standalone /mfa page render the right input (authenticator vs. emailed code) regardless of which flow created the challenge.
GET	/api/v1/mfa/devices	List devices
DELETE	/api/v1/mfa/devices/{id}	Delete a device
POST	/api/v1/mfa/enroll	Create an enroll
POST	/api/v1/mfa/resend-code	Create a resend code
POST	/api/v1/mfa/resend-enrollment-code	Create a resend enrollment code
POST	/api/v1/mfa/verify-enrollment	Create a verify enrollment
POST	/api/v1/mfa/verify-login	Create a verify login

Read-only — lets the standalone /mfa page render the right input (authenticator vs. emailed code) regardless of which flow created the challenge.

GET /api/v1/mfa/challenge

Read-only — lets the standalone /mfa page render the right input (authenticator vs. emailed code) regardless of which flow created the challenge. Never consumes the challenge or reveals the code.

Authentication: Part of a person's sign-in (no credential of its own). An access key is refused (PERSON_ONLY): this route is the person's second sign-in factor.

Query parameters

Name	Type	Required	Notes
token	any	no

Example

curl -X GET "https://huudis.com/api/v1/mfa/challenge" \
  -H "Authorization: Bearer <access token>"

List devices

GET /api/v1/mfa/devices

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route is the person's second sign-in factor.

Example

curl -X GET "https://huudis.com/api/v1/mfa/devices" \
  -H "Authorization: Bearer <access token>"

Delete a device

DELETE /api/v1/mfa/devices/{id}

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route is the person's second sign-in factor.

Path parameters

Name	Type	Required	Notes
id	string	yes

Example

curl -X DELETE "https://huudis.com/api/v1/mfa/devices/:id" \
  -H "Authorization: Bearer <access token>"

Create an enroll

POST /api/v1/mfa/enroll

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route is the person's second sign-in factor.

Body

Field	Type	Required	Notes
method	totp or email	no
label	string	no	max length 80

Example

curl -X POST "https://huudis.com/api/v1/mfa/enroll" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"method":"totp","label":"…"}'

Create a resend code

POST /api/v1/mfa/resend-code

Authentication: Part of a person's sign-in (no credential of its own). An access key is refused (PERSON_ONLY): this route is the person's second sign-in factor.

Body

Field	Type	Required	Notes
mfaChallengeToken	string	yes	min length 20; max length 200

Example

curl -X POST "https://huudis.com/api/v1/mfa/resend-code" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"mfaChallengeToken":"…"}'

Create a resend enrollment code

POST /api/v1/mfa/resend-enrollment-code

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route is the person's second sign-in factor.

Body

Field	Type	Required	Notes
deviceId	string	yes

Example

curl -X POST "https://huudis.com/api/v1/mfa/resend-enrollment-code" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"deviceId":"…"}'

Create a verify enrollment

POST /api/v1/mfa/verify-enrollment

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route is the person's second sign-in factor.

Body

Field	Type	Required	Notes
deviceId	string	yes
code	string	no	min length 6; max length 10
totpCode	string	no	min length 6; max length 10

Example

curl -X POST "https://huudis.com/api/v1/mfa/verify-enrollment" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"deviceId":"…","code":"…","totpCode":"…"}'

Create a verify login

POST /api/v1/mfa/verify-login

Authentication: Part of a person's sign-in (no credential of its own). An access key is refused (PERSON_ONLY): this route is the person's second sign-in factor.

Body

Field	Type	Required	Notes
mfaChallengeToken	string	yes	min length 20; max length 200
code	string	yes	min length 6; max length 20

Example

curl -X POST "https://huudis.com/api/v1/mfa/verify-login" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"mfaChallengeToken":"…","code":"…"}'