Error
A valid request URL is required to generate request examples{
"token": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"email": "jsmith@example.com",
"avatar_url": "<string>",
"totp_enabled": true,
"created_at": "2023-11-07T05:31:56Z"
},
"organizations": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"public_code": "<string>",
"name": "<string>",
"logo_url": "<string>",
"role": "<string>"
}
],
"active_organization_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"active_organization_code": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authentication
Complete a two-factor sign-in
Exchanges the challenge token plus a TOTP or recovery code for a real session. A wrong code does not consume the challenge — the rate limit is what bounds guessing. A recovery code is single-use and mails the account’s owner.
Rate limited to 20 requests per 5 minutes per IP.
POST
/
v1
/
auth
/
two-factor
Error
A valid request URL is required to generate request examples{
"token": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"email": "jsmith@example.com",
"avatar_url": "<string>",
"totp_enabled": true,
"created_at": "2023-11-07T05:31:56Z"
},
"organizations": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"public_code": "<string>",
"name": "<string>",
"logo_url": "<string>",
"role": "<string>"
}
],
"active_organization_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"active_organization_code": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Body
application/json
Response
Signed in.
uk_st_…. Shown once.
The public shape of a user. What is not listed here — the password hash, the TOTP secret — never reaches a response body.
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Null, with organizations empty, when the account is in no organization — it was removed from its last one. Signing in still succeeds and the session still works for the account-level routes; send the person to a chooser rather than into an organization.