Skip to content
Optiwork API Docs

Answer a challenge from a device

POST
/mfa/attempts/{attempt}
curl --request POST \
  --url https://work.optidata.cloud/api/mfa/attempts/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "uuid": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "mfa_device_identifier": "example", "mfa_pending_request_identifier": "example", "data": "example", "signature": "example" }'

Confirms an open challenge by presenting a signature produced with the device’s private key. The signed data must restate the challenge identifier, the device identifier and the caller’s UUID; any mismatch, an unconfirmed device, a device belonging to another user, or a challenge that is no longer pending all fail with 422.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters”
attempt
required
string

Public identifier of the challenge.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
uuid
required

UUID of the calling user.

string format: uuid
mfa_device_identifier
required

Identifier of the device producing the proof.

string
mfa_pending_request_identifier
required

Identifier of the challenge being answered.

string
data
required

The payload that was signed.

string
signature
required

Signature of data under the device’s private key.

string
Examplegenerated
{
  "uuid": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "mfa_device_identifier": "example",
  "mfa_pending_request_identifier": "example",
  "data": "example",
  "signature": "example"
}

Responses

Section titled “ Responses ”

200

Section titled “200”

The challenge was approved.

Media typeapplication/json
object
success
boolean
mfa_pending_request
object
identifier
string
status
string
data

Echo of the validated proof fields.

object
key
additional properties
any
Examples
Exampleapproved
{
  "success": true,
  "mfa_pending_request": {
    "identifier": "mfr_7cf1a9d2",
    "status": "approved"
  }
}

401

Section titled “401”

Missing, malformed or expired authentication key.

Media typeapplication/json

Authentication failures use an error key rather than message.

object
error
required
string
Examples
Examplemissing

No bearer token sent

{
  "error": "JWT passport exception: Missing bearer token in request"
}

404

Section titled “404”

The resource does not exist, or does not belong to the given drive.

Media typeapplication/json

Generic error envelope used by policy, binding and framework failures.

object
message
required

Human-readable description of the failure.

string
Examples
Examplemissing
{
  "message": "No query results for model [App\\Models\\Node] 99999999"
}

422

Section titled “422”

The request body or query string failed validation.

Media typeapplication/json
object
message
required

The first validation message.

string
errors
required

Validation messages keyed by field name.

object
key
additional properties
Array<string>
Examples
Exampleinvalid
{
  "message": "The name field is required.",
  "errors": {
    "name": [
      "The name field is required."
    ]
  }
}

429

Section titled “429”

Rate limit exceeded. Retry after the window resets.

Media typeapplication/json

Generic error envelope used by policy, binding and framework failures.

object
message
required

Human-readable description of the failure.

string
Examples
Examplethrottled
{
  "message": "Too Many Attempts."
}