Cortex Docs
API ReferenceUser Endpoints

User/2 F A

User two-factor authentication (TOTP) endpoints.

GET
/api/user/2fa/v1/status

Authorization

user-access-token
AuthorizationBearer <token>

User access token. In Apidog use token value {{user_access_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"
timezone?string

Client timezone

Default"UTC"
device?string

Client device type/details

Default"ios"
Accept-Language?string

Client language/locale preference

Default"en"
Authorization*string

Requires the user access token generated by the login or refresh endpoint. Apidog value: Bearer {{user_access_token}}.

Default"Bearer {{user_access_token}}"

Response Body

application/json

curl -X GET "https://example.com/api/user/2fa/v1/status" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_access_token}}"
{  "code": "string",  "response": {    "enabled": true,    "method": "string",    "recoveryCodesRemaining": 0  }}
POST
/api/user/2fa/v1/totp/setup

Authorization

user-access-token
AuthorizationBearer <token>

User access token. In Apidog use token value {{user_access_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"
timezone?string

Client timezone

Default"UTC"
device?string

Client device type/details

Default"ios"
Accept-Language?string

Client language/locale preference

Default"en"
Authorization*string

Requires the user access token generated by the login or refresh endpoint. Apidog value: Bearer {{user_access_token}}.

Default"Bearer {{user_access_token}}"

Response Body

application/json

curl -X POST "https://example.com/api/user/2fa/v1/totp/setup" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_access_token}}"
{  "code": "string",  "response": {    "setupId": "string",    "issuer": "string",    "accountName": "string",    "otpauthUri": "http://example.com",    "manualKey": "string",    "expiresAt": "string"  }}
POST
/api/user/2fa/v1/totp/enable

Authorization

user-access-token
AuthorizationBearer <token>

User access token. In Apidog use token value {{user_access_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"
timezone?string

Client timezone

Default"UTC"
device?string

Client device type/details

Default"ios"
Accept-Language?string

Client language/locale preference

Default"en"
Authorization*string

Requires the user access token generated by the login or refresh endpoint. Apidog value: Bearer {{user_access_token}}.

Default"Bearer {{user_access_token}}"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

curl -X POST "https://example.com/api/user/2fa/v1/totp/enable" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_access_token}}" \  -H "Content-Type: application/json" \  -d '{    "setupId": "f4709ab9-abc4-47f4-b2d4-4bb2be280931",    "code": "string"  }'
{  "code": "string",  "response": {    "enabled": true,    "recoveryCodes": [      "string"    ]  }}
POST
/api/user/2fa/v1/disable

Authorization

user-access-token
AuthorizationBearer <token>

User access token. In Apidog use token value {{user_access_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"
timezone?string

Client timezone

Default"UTC"
device?string

Client device type/details

Default"ios"
Accept-Language?string

Client language/locale preference

Default"en"
Authorization*string

Requires the user access token generated by the login or refresh endpoint. Apidog value: Bearer {{user_access_token}}.

Default"Bearer {{user_access_token}}"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/user/2fa/v1/disable" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_access_token}}" \  -H "Content-Type: application/json" \  -d '{    "code": "string"  }'
{  "code": "string",  "message": "string"}
POST
/api/user/2fa/v1/recovery_codes/regenerate

Authorization

user-access-token
AuthorizationBearer <token>

User access token. In Apidog use token value {{user_access_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"
timezone?string

Client timezone

Default"UTC"
device?string

Client device type/details

Default"ios"
Accept-Language?string

Client language/locale preference

Default"en"
Authorization*string

Requires the user access token generated by the login or refresh endpoint. Apidog value: Bearer {{user_access_token}}.

Default"Bearer {{user_access_token}}"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

curl -X POST "https://example.com/api/user/2fa/v1/recovery_codes/regenerate" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_access_token}}" \  -H "Content-Type: application/json" \  -d '{    "code": "string"  }'
{  "code": "string",  "response": {    "enabled": true,    "recoveryCodes": [      "string"    ]  }}
POST
/api/user/2fa/v1/login/verify

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"
timezone?string

Client timezone

Default"UTC"
device?string

Client device type/details

Default"ios"
Accept-Language?string

Client language/locale preference

Default"en"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

curl -X POST "https://example.com/api/user/2fa/v1/login/verify" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Content-Type: application/json" \  -d '{    "code": "string"  }'
{  "code": "string",  "response": {    "accessToken": "string",    "refreshToken": "string",    "sessionId": "string",    "user": {      "_id": "string",      "loginType": "email",      "email": "string",      "profile": {        "name": "string",        "locale": "en",        "timezone": "utc",        "currency": "usd"      },      "twoFactor": {},      "onboardingCompleted": true    }  }}