Frontegg MFA API

openapi: 3.0.0
info:
  title: Multi-Apps Overview Account Invitations MFA API
  description: Frontegg’s Multi-Apps feature simplifies and streamlines application management, delivering a seamless user experience. This section includes all necessary endpoints for managing applications and copying application settings across environments. All endpoints are categorized as **Management Endpoints**, requiring environment-level authorization and providing full control over entitlement resources.
  version: '1.0'
  x-metadata:
    note: Trigger publish artifacts job, remove this x-metadata after publishing
servers:
- url: https://api.frontegg.com/applications
  description: EU Region
- url: https://api.us.frontegg.com/applications
  description: US Region
- url: https://api.ca.frontegg.com/applications
  description: CA Region
- url: https://api.au.frontegg.com/applications
  description: AU Region
- url: https://{domain}.frontegg.com/applications
  description: Frontegg sub-domain for use with user tokens
  variables:
    domain:
      default: app-xxx
tags:
- name: MFA
  x-displayName: MFA
paths:
  /resources/auth/v1/user/mfa/recover:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_recoverMfa
      summary: Recover MFA
      description: 'Recover multi-factor authentication (MFA) for a non-logged-in user.


        This endpoint verifies a user''s identity using a backup recovery code, typically generated by the user''s MFA authenticator app during initial setup.


        Use this when a user cannot access their MFA device and needs to authenticate with their recovery code.'
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RecoverMfaDto'
      responses:
        '200':
          description: ''
      tags:
      - MFA
      security:
      - bearer: []
  /resources/users/v1/mfa/disable:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersMfaControllerV1_disableAuthAppMfa
      summary: Disable Authenticator App MFA
      description: 'Disable MFA enrollment for a logged-in user within a specific account (tenant).


        This endpoint disables multi-factor authentication for a user, using the `mfaToken` obtained from the user''s authenticator app.


        Use this endpoint to programmatically disable MFA when managing authentication settings at the account (tenant) level.'
      deprecated: true
      parameters:
      - name: frontegg-user-id
        in: header
        description: The user ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DisableMFAAuthAppRequest'
      responses:
        '200':
          description: ''
      tags:
      - MFA
      security:
      - bearer: []
  /resources/users/v1/mfa/authenticator/{deviceId}/disable/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersMfaControllerV1_disableAuthenticatorMfa
      summary: Disable Authenticator App MFA
      description: 'Disable multi-factor authentication (MFA) enrollment for a logged-in user within a specific account (tenant).


        This endpoint removes MFA for a user, typically used in administrative contexts where a backend system or admin manages user security settings.


        The request must include the `mfaToken`, which is the time-based one-time password (TOTP) generated by the user''s authenticator app.


        Use this endpoint to programmatically disable MFA for a specific user within an account (tenant).'
      parameters:
      - name: deviceId
        required: true
        in: path
        schema:
          type: string
      - name: frontegg-user-id
        in: header
        description: The user ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DisableMFAAuthAppRequest'
      responses:
        '200':
          description: ''
      tags:
      - MFA
      security:
      - bearer: []
  /resources/users/v1/mfa/sms/{deviceId}/disable:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersMfaControllerV1_preDisableSMSMfa
      summary: Pre-disable SMS MFA
      parameters:
      - name: deviceId
        required: true
        in: path
        schema:
          type: string
      - name: frontegg-user-id
        in: header
        description: The user ID identifier
        required: true
        schema:
          type: string
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestDisableMFARequest'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestDisableMFASMSResponse'
      tags:
      - MFA
      description: 'Initiate the process of disabling SMS-based multi-factor authentication (MFA) for a specific device.


        Provide the target `deviceId` in the request path to mark the SMS MFA device for pre-disablement. This action prepares the device for subsequent steps required to complete the removal.


        Use this route as part of the MFA management flow for disabling SMS-based MFA on a per-device basis.'
      security:
      - bearer: []
  /resources/users/v1/mfa/sms/{deviceId}/disable/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersMfaControllerV1_disableSMSMfa
      summary: Disable SMS MFA
      parameters:
      - name: deviceId
        required: true
        in: path
        schema:
          type: string
      - name: frontegg-user-id
        in: header
        description: The user ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DisableMFASMSRequest'
      responses:
        '200':
          description: ''
      tags:
      - MFA
      description: 'Complete the process of disabling SMS-based multi-factor authentication (MFA) for a specific device.


        This step finalizes MFA deactivation for the given `deviceId` after a prior pre-disable action.


        The request must include:

        - `otcToken`: The one-time challenge token obtained during the pre-disable step.

        - `code`: The SMS verification code received by the user.


        Use this endpoint as the second step in the SMS MFA removal flow to verify the user''s identity and confirm the disable action.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_verifyAuthenticatorMfaCode
      summary: Verify MFA Using Code From Authenticator App
      description: 'Verify a multi-factor authentication (MFA) code generated by an authenticator app during the authentication process.


        This endpoint completes the MFA step by validating the provided code.


        The request must include:

        - `value`: The MFA service name (e.g., `authenticator`), as configured in your Authentication Settings.

        - `mfaToken`: The time-based one-time password (TOTP) generated by the user''s authenticator app.


        Use this endpoint to verify the user''s MFA code during an authentication challenge, typically after the primary login step.'
      deprecated: true
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyMFAAuthAppRequest'
      responses:
        '201':
          description: ''
      tags:
      - MFA
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/emailcode:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_preVerifyEmailOtcMfa
      summary: Request Verify MFA Using Email Code
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthRequestVerifyMfaRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestVerifyMFAEmailResponse'
      tags:
      - MFA
      description: 'Verify multi-factor authentication (MFA) using a code sent to the user''s email.


        This endpoint completes the email-based MFA verification step.


        The request must include:

        - `mfaToken`: The token provided after the user initiates MFA via email.


        Use this endpoint to confirm the email-based MFA challenge and finalize the login or authentication process.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/emailcode/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_verifyEmailOtcMfa
      summary: Verify MFA Using Email Code
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyMFAEmailOTCRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationResponseDto'
      tags:
      - MFA
      description: 'Verify a multi-factor authentication (MFA) challenge using a code sent to the user''s email address.


        This endpoint finalizes the email-based MFA verification and completes the authentication process.


        The request must include:

        - `otcToken`: One-time challenge token received during the email MFA initiation.

        - `code`: The MFA code sent to the user''s email.

        - `mfaToken`: Token returned from the original MFA setup or step-up authentication request.

        - `rememberDevice` (optional): If set to `true`, the device will be remembered to reduce MFA prompts on future logins from the same client.


        Use this endpoint to confirm the MFA challenge and optionally remember the current device for future sessions.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/authenticator/enroll:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_preEnrollAuthenticatorMfa
      summary: Pre Enroll MFA Using Authenticator App
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthRequestEnrollMFARequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestEnrollAuthenticatorAppMfaResponse'
      tags:
      - MFA
      description: 'Initiate enrollment in multi-factor authentication (MFA) using an authenticator app (e.g., Google Authenticator, Authy).


        This endpoint begins the MFA setup process and returns the necessary data for configuring an authenticator app, such as a QR code or secret key.


        The request must include:

        - `mfaToken`: A token received from the initial authentication flow that authorizes the MFA setup.


        Use this endpoint to generate the configuration required for linking an authenticator app before completing verification.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/authenticator/enroll/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_enrollAuthenticatorMfa
      summary: Enroll MFA Using Authenticator App
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyEnrollMFAAuthAppRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationResponseDto'
      tags:
      - MFA
      description: 'Complete enrollment in multi-factor authentication (MFA) using an authenticator app.


        This endpoint verifies the MFA setup by validating the time-based one-time password (TOTP) generated by the authenticator app.


        The request must include:

        - `token`: The 6-digit TOTP code generated by the authenticator app.

        - `mfaToken`: Token from the initial MFA enrollment initiation.

        - `rememberDevice` (optional): If set to `true`, the device will be remembered and may skip MFA on future logins from the same browser or device.


        Use this endpoint to finalize MFA enrollment and activate the authenticator app for the user''s account.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/authenticator/{deviceId}/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_verifyAuthenticatorMfa
      summary: Verify MFA Using Authenticator App
      description: 'Verify multi-factor authentication (MFA) during the authentication process.


        This endpoint is typically used after a primary login attempt when MFA is enabled for the user or account (tenant).


        The request must include:

        - `value`: The MFA service name (e.g., `authenticator`, `email`, `sms`) configured under Authentication Settings.

        - `mfaToken`: The token or code provided by the user''s MFA method (e.g., code from an authenticator app).


        Use this endpoint to complete the MFA verification step as part of the overall login flow.'
      parameters:
      - name: deviceId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyMFAAuthAppRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationResponseDto'
      tags:
      - MFA
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/sms/enroll:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_preEnrollSmsMfa
      summary: Pre-enroll MFA Using Sms
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestEnrollMFASMSRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestEnrollMFASMSResponse'
      tags:
      - MFA
      description: 'Initiate multi-factor authentication (MFA) enrollment using SMS.


        This endpoint begins the SMS-based MFA setup by sending a verification code to the provided phone number.


        The request must include:

        - `phoneNumber`: The user''s mobile phone number in international format. It must match the format defined in your organization''s phone number validation pattern (`phoneNumberRegexp`).


        Use this endpoint as the first step in enabling SMS-based MFA for a user.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/sms/enroll/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_enrollSmsMfa
      summary: Enroll MFA Using Sms
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyEnrollMFASMSRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationResponseDto'
      tags:
      - MFA
      description: 'Complete enrollment in multi-factor authentication (MFA) using SMS.


        This endpoint finalizes the SMS-based MFA setup for the user by verifying the code sent to their phone number.


        The request must include:

        - `otcToken`: Token received from the initial SMS MFA enrollment step.

        - `code`: The numeric code sent via SMS to the user''s registered phone number.


        Use this endpoint to verify the user''s phone number and activate SMS-based MFA on their account.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/sms/{deviceId}:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_preVerifySmsMfa
      summary: Request to Verify MFA Using Sms
      parameters:
      - name: deviceId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthRequestVerifyMfaRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestVerifyMFASMSResponse'
      tags:
      - MFA
      description: 'Verify multi-factor authentication (MFA) using an SMS-based device.


        This endpoint confirms the SMS MFA challenge as part of the authentication or step-up verification process for a specific registered device.


        Path parameters:

        - `deviceId`: The unique identifier of the SMS MFA device being verified.


        Request body must include:

        - `mfaToken`: Token provided during the authentication or challenge flow.


        Use this endpoint to complete SMS-based MFA verification for the specified device.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/sms/{deviceId}/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_verifySmsMfa
      summary: Verify MFA Using Sms
      parameters:
      - name: deviceId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyMFASMSRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationResponseDto'
      tags:
      - MFA
      description: 'Verify a multi-factor authentication (MFA) challenge using an SMS code for a specific registered device.


        This endpoint finalizes the MFA step by validating the SMS code and may mark the device as trusted if specified.


        Path parameters:

        - `deviceId`: The unique identifier of the SMS MFA device being verified.


        Request body must include:

        - `otcToken`: Token received from the SMS MFA challenge initiation.

        - `code`: The verification code sent to the user''s phone via SMS.

        - `mfaToken`: MFA token issued during the initial login or step-up challenge.

        - `rememberDevice` (optional): Set to `true` to remember the device and reduce future MFA prompts on this device.


        Use this endpoint to complete SMS-based MFA verification and optionally trust the device for future logins.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/webauthn/enroll:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_preEnrollWebauthnMfa
      summary: Pre Enroll MFA Using WebAuthN
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthRequestEnrollMFARequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestEnrollMFAWebAuthnResponse'
      tags:
      - MFA
      description: 'Initiate multi-factor authentication (MFA) enrollment using WebAuthn (e.g., security keys, biometrics).


        This endpoint begins the WebAuthn MFA setup by returning a browser-based challenge needed to link a trusted device, such as a biometric reader or hardware security key.


        The request must include:

        - `mfaToken`: Token issued during the authentication flow to authorize MFA setup.


        Use this endpoint as the first step when enrolling a user in WebAuthn-based MFA.'
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/webauthn/enroll/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_enrollWebauthnMfa
      summary: Enroll MFA Using WebAuthN
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyEnrollMFAWebAuthnRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationResponseDto'
      tags:
      - MFA
      description: "Complete enrollment in multi-factor authentication (MFA) using WebAuthn.\n\nThis endpoint verifies and registers a WebAuthn device, such as a biometric sensor (Platform) or hardware security key (CrossPlatform), finalizing the setup after the initial challenge.\n\nThe request must include:\n- `deviceType`: Type of device being enrolled. Accepts `Platform` (e.g., fingerprint scanner) or `CrossPlatform` (e.g., USB security key).\n- `webauthnToken`: Token received during the WebAuthn pre-enrollment step.\n- `options`: WebAuthn attestation data collected from the client.\n  - `id`: Device identifier.\n  - `response`: WebAuthn attestation response.\n    - `clientDataJSON`: Base64-encoded client data from the browser.\n    - `attestationObject`: Base64-encoded attestation object from the authenticator.\n  - `deviceType` (optional): May repeat the selected device type.\n- `mfaToken`: Token used to authorize MFA enrollment.\n- `rememberDevice` (optional): Set to `true` to remember the device and reduce MFA prompts on future logins.\n\nUse this endpoint to complete WebAuthn-based MFA enrollment and register the user's trusted device."
      security:
      - bearer: []
  /resources/auth/v1/user/mfa/webauthn/{deviceId}:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: AuthenticationMFAControllerV1_preVerifyWebauthnMfa
      summary: Request Verify MFA Using WebAuthN
      parameters:
      - name: deviceId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthRequestVerifyMfaRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestVerifyMFAWebAuthnResponse'
      tags:
      - MFA
      description: 'Verify a multi-factor authentication (MFA) challenge using a registered WebAuthn device.


        This endpoint completes WebAuthn-based MFA verification, typically following primary authentication when WebAuthn is required as a second factor.


        Path parameters:

        - `deviceId`: The unique identifier of the WebAuthn device to be verified.


        Request body must include:

        - `mfaToken`: Token issued during the login or step-up authentication flow.


        Use this endpoint to validate a WebAuthn device and complete the MFA step during authentication.'
      security:
      - bear

# --- truncated at 32 KB (54 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/frontegg/refs/heads/main/openapi/frontegg-mfa-api-openapi.yml