Generate Google Authenticator QR and manual setup key
Requires current password. Returns a locally generated PNG QR and otpauth URI (SHA1, 6 digits, 30s), never an external QR service. Pending setup expires after 10 minutes; repeating setup resumes it without resetting the guess budget. Does not enable 2FA until confirm succeeds. Secrets must not be logged or cached. Already enabled returns 409; unavailable encryption returns 503.
bearerAuthAuthorizationBearer <token>Obtained from POST /api/v1/auth/login, on the tenant's own subdomain. Presenting it on another tenant's subdomain is a 403.
application/json- body
currentPassword*stringpassword0 <= length <= 72Pending enrollment and QR generated
*/*- response
enrollmentId?stringuuidexpiresAt?stringdate-timeotpauthUri?stringqrDataUrl?stringsecret?stringcurl -X POST 'https://api.monetaryai.uz/api/v1/me/security/authenticator/setup' \ -H 'Content-Type: application/json' \ -d '{ "currentPassword": "pa$$word"}'{ "enrollmentId": "883e2903-3e2f-407c-ae2a-1274a4137945", "expiresAt": "2019-08-24T14:15:22Z", "otpauthUri": "string", "qrDataUrl": "string", "secret": "string"}Disable Google Authenticator using password and second factor POST
Requires current password and one fresh six-digit code OR one unused recoveryCode. Removes the secret/recovery codes and revokes every session/JWT. Password reset never disables TOTP. Login again after success.
Email a code to enable or disable 2FA POST
Requires current password; recipient is always the account's stored email, never request input. Eight-digit code expires in five minutes and allows five guesses. At most five issues per user/hour, twenty per IP/hour and one per purpose/minute. 202 is queue acceptance, not delivery. Only provider-acknowledged codes can be redeemed.