---
title: "Verify MFA Passcode"
method: POST
path: "/v1/users/{id}/mfa/verify"
tags: ["MFA API"]
---

# Verify MFA Passcode

`POST /v1/users/{id}/mfa/verify`

Use this endpoint to verify the MFA passcode entered by the user during setup. Must be called after initiating setup and before enabling MFA.

## Path parameters

- `id` string, required

## Request body

- MFAVerifyInput — Information required to verify an MFA passcode during setup.
  - `passcode` string, required — The OTP passcode to verify.
  - `secret` string — The TOTP secret (required for app-based MFA).
  - `mfaType` 'app' | 'email' | 'sms', required — The type of MFA being verified.
  - `countryCode` string — ISO 3166-1 alpha-2 country code (e.g. "BR", "US"). Used to resolve the phone number for SMS MFA. Not a dial prefix (+55).

## Response `200`

MFA passcode verified successfully.

- object
  - `verified` boolean

## Other responses

- `400`
- `404`
- `500`

---

[API](https://skmtc.net/lerian/apis/identity-plugin.md) · [All operations](https://skmtc.net/lerian/apis/identity-plugin/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lerian/identity-plugin/versions/25daba385532/schema)