POST /v1/console/totp/enrol


Call	`POST /v1/console/totp/enrol`
Price	free
Scope	console session cookie (not an API key)
Operation id	`enrolTotp`

What it does

Generate a new TOTP secret for the signed-in user (RFC 6238: SHA-1, 6 digits, 30 seconds), shown once. It takes effect after POST /v1/console/totp/verify with a current code. Calling it again replaces a pending secret; when TOTP is already on, disable it first. Session cookie required.

Example request

Copy it as curl. Set VERDICT_API_KEY first; uuidgen makes a fresh Idempotency-Key.

curl -X POST 'https://api.askverdict.io/v1/console/totp/enrol' \
  --cookie "verdict_session=$VERDICT_SESSION" \
  -H "Idempotency-Key: $(uuidgen)"

Example response

201: The pending secret.

{
  "secret": "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP",
  "otpauth_uri": "otpauth://totp/Verdict:dana%40northwind-ops.io?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=Verdict&algorithm=SHA1&digits=6&period=30"
}

Parameters

Name	In	Type	Required	Description
`idempotency-key`	header	string (uuid)	yes	A UUID you generate per logical request. Required on every POST. Repeating it within 24 hours returns the stored response and bills nothing; reusing it with a different body returns 409 `idempotency_conflict`.

Response fields (201)

Schema TotpEnrolResponse.

Field	Type	Required	Description
`secret`	string	yes	The base32 TOTP secret (shown once). Add it to an authenticator app, then confirm with a code.
`otpauth_uri`	string	yes	The same secret as an `otpauth://` URI, to render as a QR code.

Errors

Errors are RFC 9457 problem details and are never billed. Branch on type. See Errors.

Status	Meaning
`400`	Invalid request: malformed JSON, an unknown field, a failed constraint or a size limit (`invalid_request`).
`401`	Missing, malformed, revoked or expired API key, or a bad webhook signature (`unauthorized`).
`409`	The `Idempotency-Key` was reused with a different request, or the first request is still running (`idempotency_conflict`).
`429`	Rate limited (`rate_limited`). Wait `Retry-After` seconds.
`500`	Unexpected server error (`internal`). Not billed; retry with the same `Idempotency-Key`.

Try it

Open the interactive reference to send this request from the browser. The full document is at /openapi.json.