Initiate MFA Setup
Begins enrolling one second factor and returns what the device needs to complete it — for an authenticator app, the secret and its QR code; for e-mail, a code is sent to the address already on the account.
Two channels are served: app and email. SMS is not one of them, and asking for it is refused.
First of THREE calls, and none of them alone protects anything: setup, then POST /v1/users/{id}/mfa/verify to prove the device works, then POST /v1/users/{id}/mfa/enable to turn it on. A channel left after step one or two is not protecting the account.
Failures:
400— the channel is not one this service serves.404— no such user.503 IDE-0066— the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.
Authorizations
JWT bearer token issued by the identity provider.
Path Parameters
User ID.
"00000000-0000-0000-0000-000000000000"
Body
Which channel to enrol.
"app"

