---
title: "MFA step-up for API session"
method: POST
path: "/v3/mfa/step-up"
tags: ["mfa"]
---

# MFA step-up for API session

`POST /v3/mfa/step-up`

Set your current API session as MFA trusted.

Ideally, when you sign in with `POST /v3/login`, set `rememberMeId` and `device` in your request to generate an MFA-trusted API session.

In case you sign in without `rememberMeId` and `device` in your request, you can use this `POST /v3/mfa/step-up` endpoint to mark the current API session as MFA trusted.

## Headers

- `sessionId` string, nullable — API session ID generated with `/v3/login`
- `devKey` string, nullable — Developer key generated with your BILL developer account

## Request body

- MfaStepUpRequestDto — Step-up request for MFA
  - `rememberMeId` string — MFA ID. Set this field for creating an MFA-trusted API session. This MFA ID is generated when you set `rememberMe` as `true` in your `POST /v3/mfa/challenge/validate` request. This value expires in 30 days. See [Validate MFA challenge](https://developer.bill.com/reference/validatechallenge) for more information.
  - `device` string — Mobile device name. This is a nickname for your mobile device. Set this field when you set `rememberMeId`.

## Response `200`

MFA step-up for API session response

- MfaStepUpResponseDto — Step-up response.
  - `trusted` boolean — This field is set as `true` if the current API session is MFA-trusted

---

[API](https://skmtc.net/bill/apis/bill-v3-api.md) · [All operations](https://skmtc.net/bill/apis/bill-v3-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bill/bill-v3-api/revisions/0483350c434e/schema)