> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Confirm an MFA enrollment and continue the login

> Confirms the factor started by setup with its first passcode, enables it, and continues the login with the normal MFA challenge under the SAME mfaToken. Wrong passcodes are charged to the same per-user attempt budget as verify (AUT-0018 at the cap). Public: authenticated by the enrollment-only mfaToken.



## OpenAPI

````yaml /es/openapi/v3-current/AM-auth.yaml post /v1/login/mfa/confirm
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager auth component.
  license:
    name: Lerian Studio General License
  title: Access Manager Auth API
  version: v1
servers:
  - url: https://auth.sandbox.lerian.net
security: []
tags:
  - description: >-
      OAuth2 token issuance: request an access token, refresh it, and log out.
      Public issuer endpoints.
    name: OAuth
  - description: >-
      Single sign-on through the tenant's identity provider: discover how an
      email signs in, then start the login. Public, called by the browser before
      login.
    name: SSO
  - description: >-
      Multi-factor authentication challenge and verification during the login
      flow. Public (identity is carried by the MFA token, not a Bearer token).
    name: MFA
  - description: >-
      Token-secured routes: enforce a permission, list the caller's permissions,
      and fetch OIDC user info. Require a Bearer token, validated in the use
      case.
    name: User Permission
paths:
  /v1/login/mfa/confirm:
    post:
      tags:
        - MFA
      summary: Confirm an MFA enrollment and continue the login
      description: >-
        Confirms the factor started by setup with its first passcode, enables
        it, and continues the login with the normal MFA challenge under the SAME
        mfaToken. Wrong passcodes are charged to the same per-user attempt
        budget as verify (AUT-0018 at the cap). Public: authenticated by the
        enrollment-only mfaToken.
      operationId: confirmMFAEnrollment
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MFAConfirmInput'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MFAChallengeResponse'
          description: OK
        '422':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Service Unavailable
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Error
components:
  schemas:
    MFAConfirmInput:
      additionalProperties: false
      properties:
        mfaToken:
          description: The enrollment-only token of a 401 AUT-0019 refusal.
          examples:
            - eyJhbGciOiJIUzI1NiJ9...
          type: string
        mfaType:
          description: The factor set up.
          enum:
            - app
            - email
          examples:
            - app
          type: string
        passcode:
          description: The one-time passcode (6 numeric digits) read off the new factor.
          examples:
            - '******'
          type: string
      required:
        - mfaToken
        - mfaType
        - passcode
      type: object
    MFAChallengeResponse:
      additionalProperties: false
      properties:
        availableMethods:
          examples:
            - - app
              - email
          items:
            type: string
          type:
            - array
            - 'null'
        mfaRequired:
          examples:
            - true
          type: boolean
        mfaToken:
          examples:
            - eyJhbGciOiJIUzI1NiJ9...
          type: string
        preferredMethod:
          examples:
            - app
          type: string
      required:
        - mfaRequired
        - mfaToken
        - availableMethods
        - preferredMethod
      type: object
    Detail:
      additionalProperties: true
      properties:
        code:
          description: >-
            Stable, machine-readable domain error code scoped to the emitting
            service (format: <SERVICE>-NNNN).
          type: string
        detail:
          description: >-
            A human-readable explanation specific to this occurrence of the
            problem.
          examples:
            - Property foo is required but is missing.
          type: string
        errors:
          description: Optional list of individual error details
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type:
            - array
            - 'null'
        instance:
          description: >-
            A URI reference that identifies the specific occurrence of the
            problem.
          examples:
            - https://example.com/error-log/abc123
          format: uri
          type: string
        status:
          description: HTTP status code
          examples:
            - 400
          format: int64
          type: integer
        title:
          description: >-
            A short, human-readable summary of the problem type. This value
            should not change between occurrences of the error.
          examples:
            - Bad Request
          type: string
        type:
          default: about:blank
          description: A URI reference to human-readable documentation for the error.
          examples:
            - https://example.com/errors/example
          format: uri
          type: string
        upstream:
          $ref: '#/components/schemas/Upstream'
          description: >-
            RFC 9457 extension member: the error a proxied third-party provider
            reported. Absent unless the emitting service explicitly surfaced
            one.
      type: object
    ErrorDetail:
      additionalProperties: false
      properties:
        location:
          description: >-
            Where the error occurred, e.g. 'body.items[3].tags' or
            'path.thing-id'
          type: string
        message:
          description: Error message text
          type: string
        value:
          description: The value at the given location
      type: object
    Upstream:
      additionalProperties: false
      properties:
        code:
          description: The upstream provider's own error code, verbatim.
          examples:
            - E4001
          type: string
        message:
          description: >-
            The upstream provider's own error message, verbatim (bounded, never
            its raw response body).
          examples:
            - account not found at provider
          type: string
      type: object

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.