Error
A valid request URL is required to generate request examples{
"secret": "<string>",
"otpauth_url": "<string>",
"qr_data_uri": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Two-factor
Start two-factor setup
Generates a secret and returns the QR to scan. It does not turn two-factor on — that only happens once the user proves they can produce a code, so an abandoned setup never locks anyone out.
POST
/
v1
/
account
/
two-factor
/
setup
Error
A valid request URL is required to generate request examples{
"secret": "<string>",
"otpauth_url": "<string>",
"qr_data_uri": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.