Confirm a TOTP device with its first code

POST 
/api/v1/mfa/devices/:deviceId/verify

Verifies the device and, in the password-reset flow, issues a fresh restricted MFA-reset cookie; otherwise issues full auth cookies and creates a session (this endpoint doubles as "finish enrollment" and, for the password-reset flow, "MFA step-up").

Request

Responses

200

Device verified

Response Headers

Set-Cookie

Either full auth cookies (safebucket_access_token + safebucket_refresh_token) if no MFA step-up is needed, or a single restricted safebucket_mfa_token cookie if mfa_required: true is returned in the body.

401

Invalid or replayed TOTP code (INVALID_MFA_CODE)

404

Device not found (MFA_DEVICE_NOT_FOUND)

409

Device already verified (MFA_DEVICE_ALREADY_VERIFIED)

429

Too many failed attempts (MFA_RATE_LIMITED)