Skip to content
Optiwork API Docs

Open an MFA challenge

POST
/mfa/users/{user}/request
curl --request POST \
  --url https://work.optidata.cloud/api/mfa/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/request \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "is_2fa": true }'

Creates a challenge the user must confirm from one of their registered devices.

The response carries mfa_pending_request: null — meaning no challenge is needed — in two cases: is_2fa was true but the user has two-factor login switched off, or the request is a generic identity confirmation and the user has no confirmed device.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters”
user
required
string format: uuid

UUID of the user to challenge.

Request Body

Section titled “Request Body”
Media typeapplication/json
object
is_2fa

true for a login second factor, which is skipped when the user has two-factor login disabled. Omit for a generic identity confirmation.

boolean | null
ip

IP address to record on the challenge.

string | null
user_agent

User agent to record on the challenge.

string | null
Examples
Examplelogin
{
  "is_2fa": true
}

Responses

Section titled “ Responses ”

200

Section titled “200”

The challenge, or null when none is required.

Media typeapplication/json
object
mfa_pending_request
required
One of:

A challenge waiting to be confirmed from a registered device.

object
id
integer format: int64
identifier

Public identifier of the request, used in paths.

string
user_id
integer format: int64
mfa_device_id
integer | null format: int64
status
string
Allowed values: pending approved rejected
ip
string | null
user_agent
string | null
app_id
integer | null
created_at
string format: date-time
Examples

Challenge opened

{
  "mfa_pending_request": {
    "id": 908,
    "identifier": "mfr_7cf1a9d2",
    "user_id": 15,
    "status": "pending",
    "created_at": "2026-08-19T12:59:17.000000Z"
  }
}

401

Section titled “401”

Missing, malformed or expired authentication key.

Media typeapplication/json

Authentication failures use an error key rather than message.

object
error
required
string
Examples
Examplemissing

No bearer token sent

{
  "error": "JWT passport exception: Missing bearer token in request"
}

404

Section titled “404”

The resource does not exist, or does not belong to the given drive.

Media typeapplication/json

Generic error envelope used by policy, binding and framework failures.

object
message
required

Human-readable description of the failure.

string
Examples
Examplemissing
{
  "message": "No query results for model [App\\Models\\Node] 99999999"
}

422

Section titled “422”

The request body or query string failed validation.

Media typeapplication/json
object
message
required

The first validation message.

string
errors
required

Validation messages keyed by field name.

object
key
additional properties
Array<string>
Examples
Exampleinvalid
{
  "message": "The name field is required.",
  "errors": {
    "name": [
      "The name field is required."
    ]
  }
}

429

Section titled “429”

Rate limit exceeded. Retry after the window resets.

Media typeapplication/json

Generic error envelope used by policy, binding and framework failures.

object
message
required

Human-readable description of the failure.

string
Examples
Examplethrottled
{
  "message": "Too Many Attempts."
}