# Client API: Authentication MFA

> Every Client API operation tagged Authentication MFA.

Source: https://docs.coritan.com/api/reference/client/authentication-mfa/

Base URL: `https://api.coritan.com/api/v1`. Paths below are complete.

To try these requests in the browser, open the [interactive Client API reference](https://api.coritan.com/docs).

## Operations

| Method | Path | Summary |
| --- | --- | --- |
| GET | [`/api/v1/auth/mfa`](#op-get-api-v1-auth-mfa) | User MFA status |
| POST | [`/api/v1/auth/mfa/disable`](#op-post-api-v1-auth-mfa-disable) | User MFA disable |
| POST | [`/api/v1/auth/mfa/enable`](#op-post-api-v1-auth-mfa-enable) | User MFA enable |
| POST | [`/api/v1/auth/mfa/recovery-codes`](#op-post-api-v1-auth-mfa-recovery-codes) | User MFA regenerate recovery codes |
| POST | [`/api/v1/auth/mfa/setup`](#op-post-api-v1-auth-mfa-setup) | User MFA setup |
| POST | [`/api/v1/auth/mfa/verify`](#op-post-api-v1-auth-mfa-verify) | Second step of signing in |

### User MFA status {#op-get-api-v1-auth-mfa}

`GET /api/v1/auth/mfa`

Authentication: an access token, sent as `Authorization: Bearer <token>`.

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |

### User MFA disable {#op-post-api-v1-auth-mfa-disable}

`POST /api/v1/auth/mfa/disable`

Authentication: an access token, sent as `Authorization: Bearer <token>`.

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `password` | string | yes |
| `code` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### User MFA enable {#op-post-api-v1-auth-mfa-enable}

`POST /api/v1/auth/mfa/enable`

Authentication: an access token, sent as `Authorization: Bearer <token>`.

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `code` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### User MFA regenerate recovery codes {#op-post-api-v1-auth-mfa-recovery-codes}

`POST /api/v1/auth/mfa/recovery-codes`

Authentication: an access token, sent as `Authorization: Bearer <token>`.

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `code` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### User MFA setup {#op-post-api-v1-auth-mfa-setup}

`POST /api/v1/auth/mfa/setup`

Authentication: an access token, sent as `Authorization: Bearer <token>`.

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |

### Second step of signing in {#op-post-api-v1-auth-mfa-verify}

`POST /api/v1/auth/mfa/verify`

Second step of signing in. Bearer is the pending token from ``login``.

Authentication: an access token, sent as `Authorization: Bearer <token>`.

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `code` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |