Step up the session asking

POST

/security/klock/sessions/{id}/step-up

Proves a second factor now, which wakes the session's dormant
capabilities (the admin:* ones, among others) for the kind's step-up
window. Send { totp }; a browser session on an account without a
second factor may send { password } instead. The code is single-use,
and failures count against the account's step-up lockout. Only the
session itself may step up. A klock session gets a new grant carrying
adminUntil; a bearer session gets the window.

Request

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Stepped up

Bodyapplication/json

🟠400

🟠401

🟠403

🟠404

🟠429

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/klock/sessions//step-up' \
--header 'Content-Type: application/json' \
--data '{
    "totp": "string",
    "password": "pa$$word"
}'

Response Example

200 - Example 1

{
    "sessionId": "string",
    "stepUpAt": 0,
    "grant": "string",
    "adminUntil": 0,
    "caps": [
        "string"
    ],
    "dormant": [
        "string"
    ]
}

Modified at 2026-10-05 04:04:32

Check in, for the next grant

Rotate the device key