Skip to main content
POST
Error

Body

application/json
challenge_token
string
required

uk_2fa_…, from the login response. Valid for 5 minutes.

code
string
required

A 6-digit TOTP code, or one of the recovery codes.

Response

Signed in.

token
string

uk_st_…. Shown once.

expires_at
string<date-time>
user
object

The public shape of a user. What is not listed here — the password hash, the TOTP secret — never reaches a response body.

organizations
object[]
active_organization_id
string<uuid>
active_organization_code
string