Initialize MFA Challenge

GET

/mfa/flows/{flow}/challenges/{challenge}

Initializes a specific challenge within an MFA flow and returns an updated MFA token. This endpoint is used after obtaining an MFA token from GET /mfa/:flow. The challenge will be initialized (e.g., 6-digit OTP sent via email or phone). Supported challenges: otp_email, otp_phone

Flow:

1. Authenticate user via JWT token (required).
2. Validate MFA token from X-GOTU-MFA-Token header.
3. Verify flow and challenge parameters match the MFA token.
4. Initialize the challenge (send OTP).
5. Return updated MFA token.

Authorizations

• JWT

Parameters

Path Parameters

flow

required

string

Allowed values: phone_update_flow payment_method_create_flow payment_method_select_flow payment_method_delete_flow

MFA Flow Name

challenge

required

string

Allowed values: otp_email otp_phone

MFA Challenge Name

Header Parameters

X-GOTU-MFA-Token

required

string

MFA Token from InitializeMFAFlow

Query Parameters

email

string

Email address (required for otp_email challenge for unauthenticated flows)

phone

string

Phone number (required for otp_phone challenge for unauthenticated flows)

Responses

200

OK

object

token

string

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

400

Bad request - invalid flow/challenge

object

error

string

some meaningful error message

401

Unauthorized - missing or invalid auth token

object

error

string

some meaningful error message

403

Forbidden - invalid MFA token

object

error

string

some meaningful error message

500

Internal server error

object

error

string

some meaningful error message