Enroll in MFA with access token

POST

/oauth/mfaEnrollWithToken

Last modified:2026-09-26 01:44:41

OperationId:MFAEnrollToken

Saves an authenticator app as the MFA method for the user who holds the access token. Send the token in the ns_access_token cookie or as Authorization: Bearer, and the cookie wins when both are present. During a masquerade session, the masqueraded user is enrolled. The subscriber comes from the token, never from the body. The server checks mfa_passcode against mfa_key before it saves. The enrollment is published to the platform and takes effect once it is applied. A wrong passcode still returns 200, with status error and valid false, so check status rather than the HTTP code. A missing or invalid token returns 401.

Request

Authorization

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Outcome of the enrollment. Check status: success means it was accepted, and error means a wrong passcode or a failed publish.

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/oauth/mfaEnrollWithToken' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "mfa_key": "JBSWY3DPEHPK3PXP",
    "mfa_vendor": "google",
    "mfa_type": "authenticator",
    "mfa_passcode": "123456"
}'

Response Example

200 - Success

{
    "status": "success",
    "message": "MFA enrollment successful",
    "enrolled": true,
    "apiversion": "46.0.0"
}

Modified at 2026-09-26 01:44:41

Enroll in MFA with username and password

Remove MFA enrollment