Solve MFA Challenge

POST

/mfa/flows/{flow}/challenges/{challenge}

Solves a specific challenge within an MFA flow and returns an updated MFA token. This endpoint is used after initializing a challenge via GET /mfa/:flow/:challenge. The challenge must be in PENDING status. Once solved, the status becomes PASSED. Supported challenges: otp_email, otp_phone

Flow:

1. Authenticate user via JWT token (required).
2. Validate MFA token from X-GOTU-MFA-Token header.
3. Verify flow and challenge parameters match the MFA token.
4. Verify the challenge solution (e.g., validate OTP code).
5. Update challenge status to PASSED.
6. Return updated MFA token.

Note: This function is idempotent. Solving an already PASSED challenge will return success.

Example request body per challenges:

• otp_email: {"otp":"12345"}
• otp_phone: {"otp":"12345"}

Authorizations

• JWT

Parameters

Path Parameters

flow

required

string

Allowed values: phone_update_flow payment_method_create_flow payment_method_select_flow payment_method_delete_flow

MFA Flow Name

challenge

required

string

Allowed values: otp_email otp_phone

MFA Challenge Name

Header Parameters

X-GOTU-MFA-Token

required

string

MFA Token from InitializeMFAChallenge

Request Body

Challenge solution data

object

key

additional properties

any

Responses

200

OK

object

token

string

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

400

Bad request - invalid flow/challenge or missing data

object

error

string

some meaningful error message

401

Unauthorized - missing or invalid auth token

object

error

string

some meaningful error message

403

Forbidden - invalid MFA token or incorrect solution

object

error

string

some meaningful error message

500

Internal server error

object

error

string

some meaningful error message