Enroll an MFA factor

post

https://api.wingspan.app/v3/platform/mfa-factors

Enrolls a new factor for the calling Person in PendingVerification. Type-specific enrollment artifacts (TOTP secret/QR, WebAuthn challenge, SMS last-4) are returned once and never on subsequent reads. SMS and Email factors issue a six-digit enrollment code to the requested destination; the code expires after 10 minutes, is disabled after five failed attempts, and is submitted to the verify action.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

type

string

enum

required

Allowed:

label

string

required

length between 1 and 200

smsPhone

string

E.164 — required when type=Sms.

emailAddress

string

Required when type=Email.

metadata

object

Free-form key-value pairs. Max 50 keys; key length at most 40 characters; value length at most 500 characters. Where a list endpoint declares metadata filtering, it uses the QueryQL namespace via filter[metadata.{key}][eq]=value or filter[metadata.{key}][in][]=value. Endpoints that do not declare the dynamic Metadata filter do not support Metadata filtering.

Headers

Idempotency-Key

string

length between 1 and 255

^[\x21-\x7e]{1,255}$

Optional idempotency token for authenticated POST and PATCH requests. Reusing the same key and body returns the cached response for 24 hours, except credential operations that explicitly document a 409 because one-time secret material is never cached; reusing it with a different body returns 409 IdempotencyKeyConflict. Use 1-255 printable ASCII characters.

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

201Factor enrolled, awaiting verification

401Unauthenticated

403Recent step-up MFA is required for this elevated write.

409Conflict

422Validation error