Xeonr Developer Docs
API SpecificationPRIVATEAccounts

Enroll MFA

POST
/xeonr.auth.private.v1.AccountService/EnrollMfa

Generates a new TOTP secret + provisioning URI for the authenticated user to add to an authenticator app. Requires a recent login (step-up). Enrollment is not active until confirmed via VerifyMfaEnrollment.

Required scopes: auth:account:edit

Authorization

BearerAuth
AuthorizationBearer <token>

JWT access token for internal API access. Requires 'private' scope for most endpoints, 'admin' scope for administrative operations.

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://auth.xeonr.io/xeonr.auth.private.v1.AccountService/EnrollMfa" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "secret": "JBSWY3DPEHPK3PXP",
  "provisioningUri": "otpauth://totp/Xeonr:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Xeonr"
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Disable MFA POST

Disables org-account two-factor authentication. Requires a current TOTP or recovery code to prove possession of the second factor (used instead of the account password so password-less accounts can disable). **Required scopes:** `auth:account:edit`

Get Account POST

Retrieves the full account details for the authenticated user, including connected external accounts and application enrollments. **Required scopes:** `auth:account:read`