Enroll in MFA with username and password

POST

/oauth/mfaEnroll

Last modified:2026-09-26 01:44:38

OperationId:MFAEnrollWithoutToken

Saves an authenticator app as the MFA method for a subscriber, using the user's login credentials instead of an access token. Use it in a login flow before the user has a full token, for example after /netsapiensjs reports mfa_required_setup. The server checks username and password, then checks mfa_passcode against mfa_key, and saves only when both pass. The enrollment is published to the platform and takes effect once it is applied, so a login made immediately afterwards may not see it yet. Wrong credentials return 409, and a wrong passcode returns 401: ask the user for a fresh code and try again. If the user already has a token, use /oauth/mfaEnrollWithToken instead.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

The enrollment was accepted

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠409Conflict

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/oauth/mfaEnroll' \
--header 'Content-Type: application/json' \
--data-raw '{
    "ns_id": "1001@example.com",
    "ns_id_type": "subscriber",
    "mfa_key": "JBSWY3DPEHPK3PXP",
    "mfa_vendor": "google",
    "mfa_type": "authenticator",
    "mfa_passcode": "123456",
    "username": "1001@example.com",
    "password": "{{user_password}}"
}'

Response Example

200 - Success

{
    "status": "success",
    "message": "MFA enrollment successful",
    "enrolled": true,
    "apiversion": "46.0.0"
}

Modified at 2026-09-26 01:44:38

Verify MFA passcode

Enroll in MFA with access token