The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.
The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.
No account sign-in is required. Any listed browser-origin checks and rate limits still apply.
UUID of the owning or acting account, as specified by this operation.
$ (oneOf 2).email
string; {"format":"email"}
Yes
Email address of the account or operation target. Confirmation rules depend on the operation.
$ (oneOf 2).operator
boolean
Yes
Whether the account has the admin role; this does not bypass action-code or last-admin checks.
$ (oneOf 2).return_to
string
Yes
Allowed local destination after sign-in. External and unsafe destinations are rejected.
$ (oneOf 2).status
JSON; {"const":"authenticated"}
Yes
—
$ (oneOf 3)
EntryIdle
No
—
$ (oneOf 3).status
JSON; {"const":"idle"}
Yes
—
Stable error codes
unauthorized
invalid_credential
Header
Type and limits
Meaning
Cache-Control
string; {"pattern":"(?:^|,\\s*)no-store(?:,|$)"}
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.
Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.
shell
curl --fail --silent --show-error --request GET "https://metribeacon.com/api/v1/auth/mfa"
python
import urllib.request
request = urllib.request.Request('https://metribeacon.com/api/v1/auth/mfa', method='GET', headers={})
with urllib.request.urlopen(request) as response:
print(response.status)
The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.
The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.
The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.