MFA

Get current + required MFA assurance level#

Returns `{ currentLevel, nextLevel, currentAuthenticationMethods }`. Used by the Next.js middleware to decide whether to gate on TOTP.

Antworten

• 200AAL info

curl -X GET "https://xapi.ambertech.cloud/api/v1/auth/mfa/aal" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Issue an MFA challenge#

Begins a TOTP verification cycle. The frontend then prompts the user for the 6-digit code, then calls /auth/mfa/verify with the challenge ID.

Request-Bodyapplication/jsonChallengeMfaDto

Antworten

• 200Challenge issued

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/mfa/challenge" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"factorId":"…"}'

Enroll a TOTP factor#

Starts MFA enrollment for the authenticated user. Returns the QR code, TOTP secret, and provisioning URI. The factor is in `unverified` state until /auth/mfa/verify is called with a valid TOTP code.

Request-Bodyapplication/jsonEnrollMfaDto

Antworten

• 200Enroll initiated

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/mfa/enroll" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"factorType":"totp","friendlyName":"…"}'

List the user's MFA factors#

Antworten

• 200Factor list

curl -X GET "https://xapi.ambertech.cloud/api/v1/auth/mfa/factors" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Remove an MFA factor#

Request-Bodyapplication/jsonUnenrollMfaDto

Antworten

• 200Factor removed

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/mfa/unenroll" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"factorId":"…"}'

Verify a TOTP code (promotes session to aal2)#

Verifies the 6-digit TOTP code against an outstanding challenge. On success, rotates the auth cookies to the new aal2 token pair.

Request-Bodyapplication/jsonVerifyMfaDto

Antworten

• 200Verified — cookies rotated
• 401Invalid code

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/mfa/verify" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"factorId":"…","challengeId":"…","code":"…"}'