curl --request POST \
--url https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resendimport requests
url = "https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend")
.asString();require 'uri'
require 'net/http'
url = URI("https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"two_factor_required": false,
"two_factor_enrollment_required": false,
"challenge_token": "string",
"mechanism": "string",
"masked_destination": "string",
"expires_in": 0,
"available_mechanisms": [
"string"
],
"recovery_codes_available": false
}"string""string"Re-send the one-time code for an in-progress email two-factor challenge.
Post the challenge token from the original POST /api/v1/tokens response:
{ "challenge_token": "eyJ..." }
A fresh code is emailed and a new challenge is returned (superseding
the previous one), in the same shape as the 202 from
POST /api/v1/tokens minus two_factor_required. Only Email
challenges can be resent — there is nothing to resend for Totp
(the authenticator app generates codes locally), so a Totp
challenge returns 400 with a body of not_supported. Rate limited
to 3 requests per minute (429).
curl --request POST \
--url https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resendimport requests
url = "https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend")
.asString();require 'uri'
require 'net/http'
url = URI("https://{subdomain}.outseta.com/api/v1/tokens/two-factor/resend")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"two_factor_required": false,
"two_factor_enrollment_required": false,
"challenge_token": "string",
"mechanism": "string",
"masked_destination": "string",
"expires_in": 0,
"available_mechanisms": [
"string"
],
"recovery_codes_available": false
}"string""string"Query Parameters
Response
A new code was sent; the replacement challenge is returned.
Returned when a login cannot complete with a password alone because the user has two-factor authentication enabled. Carries the opaque challenge token that must be echoed back to POST /api/v1/tokens/two-factor (or the recovery / resend / switch-mechanism endpoints) along with enough metadata for a client to render the verification step without a second round-trip. The property names are snake_case to match the wire format of the other token endpoints (see TokenPayload).
Present and true on the 202 response from POST /api/v1/tokens when the user has at least one verified 2FA method. Absent on the resend / switch-mechanism responses, which only ever follow an already-issued login challenge.
Present and true instead of two_factor_required when the tenant forces 2FA but the user has not yet enrolled any method. In that case only challenge_token and expires_in are populated and the client must route the user through the mid-login enrollment endpoints (/api/v1/tokens/two-factor/enroll/...) before a token can be issued.
Short-lived signed JWT (audience outseta:2fa-challenge) that identifies this challenge. Echo it back verbatim to complete the login.
The mechanism this challenge was issued against: Email or Totp (authenticator app). For Email a code has already been sent to the user; for Totp the user reads the current code from their authenticator app and nothing is sent.
A masked view of where an emailed code was sent (e.g. b***@outseta.com), suitable for display. Empty when mechanism is Totp.
Seconds until the challenge expires (600). After this the challenge_token can no longer be verified and the login must restart.
Every verified mechanism enrolled for this user (excluding recovery codes), e.g. ["Totp", "Email"]. A client can offer a "use a different method" option for any value other than the current mechanism via POST /api/v1/tokens/two-factor/switch-mechanism.
true when the user has a batch of recovery codes on file, in which case POST /api/v1/tokens/two-factor/recovery can be used as a fallback if they cannot produce a primary code.