Prove the app has it

POST

/security/mfa/confirm

Confirms the factor and hands out ten one-time recovery codes, shown
once. Wrong codes count against the account's step-up lockout. On a
factor already in force the code is spent (single use) and a fresh set
of recovery codes replaces the old one.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Enabled, with the recovery codes

Bodyapplication/json

🟠401

🟠403

🟠409

🟠429

🟠400ValidationError

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/mfa/confirm' \
--header 'Content-Type: application/json' \
--data '{
    "code": "string"
}'

Response Example

200 - Example 1

{
    "enabled": true,
    "recoveryCodes": [
        "string"
    ],
    "warning": "string"
}

Modified at 2026-10-05 04:04:32

Start enrolling a second factor

Remove the second factor