> ## Documentation Index > Fetch the complete documentation index at: https://docs.photon.codes/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use Stable documentation by default. Honor an explicit Beta request or a URL under /docs/beta/. If the requested version conflicts with the installed CLI package or API origin, clarify the target before writing integration code. > Pages under /docs/beta/ document Beta; other product pages document Stable. Keep the CLI package, commands, API origin, and credentials within the selected version. State the documentation version in your answer. > For MCP search, always pass version: Stable or version: Beta. Unfiltered search mixes both versions. For filesystem reads, keep Beta queries under /beta/ and exclude /beta/ from Stable queries; discover paths before reading them. > The public docs base is https://photon.codes/docs. Convert MCP page paths to public URLs under that base, preserving /beta/ when present. Read https://photon.codes/docs/skill.md for version selection and https://photon.codes/docs/llms.txt for the version indexes. # Begin TOTP enrollment > Requires a first-party interactive Account credential authenticated no more than 300 seconds ago. Returns one-time secret material. ## OpenAPI ````yaml https://api.photon.codes/openapi.json post /v1/account/security/mfa/totp openapi: 3.1.0 info: title: Photon API version: 1.0.0 servers: - url: https://api.photon.codes security: [] paths: /v1/account/security/mfa/totp: post: tags: - Account MFA summary: Begin TOTP enrollment description: >- Requires a first-party interactive Account credential authenticated no more than 300 seconds ago. Returns one-time secret material. operationId: beginTotpEnrollment parameters: [] requestBody: content: application/json: schema: $ref: '#/components/schemas/BeginTotpEnrollmentRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/BeginTotpEnrollmentResponse' description: One-time TOTP setup material and enrollment continuation. headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/NotAuthenticatedProblem' description: 'NOT_AUTHENTICATED: Not Authenticated' headers: Link: description: Optional related resources. schema: type: string RateLimit: description: Optional rate limit information. schema: type: string RateLimit-Policy: description: Optional rate limit policy. schema: type: string Retry-After: description: Optional retry delay or HTTP date. schema: type: string WWW-Authenticate: required: true schema: type: string X-Request-ID: description: Application request identifier. schema: type: string '403': content: application/problem+json: schema: $ref: '#/components/schemas/BeginTotpEnrollmentForbiddenProblem' description: >- FORBIDDEN: Forbidden FORBIDDEN: Forbidden; INSUFFICIENT_SCOPE: Insufficient Scope; ORGANIZATION_SSO_REQUIRED: Organization SSO Required headers: Deprecation: description: >- RFC 9745 structured-field Date at which the operation was or will be deprecated: `@` followed by Unix seconds, for example `@1767225599`. schema: pattern: ^@-?[0-9]+$ type: string Idempotent-Replayed: description: True when this response was replayed from an earlier attempt. schema: type: boolean Link: description: |- Links related to lifecycle or remediation documentation. Optional related resources. schema: type: string RateLimit: description: |- Current rate-limit state. Optional rate limit information. schema: type: string RateLimit-Policy: description: |- Rate-limit policy applied by the gateway. Optional rate limit policy. schema: type: string Retry-After: description: |- Delay before retrying, in seconds or as an HTTP date. Optional retry delay or HTTP date. schema: type: string Sunset: description: >- RFC 8594 HTTP-date (IMF-fixdate) after which the operation may become unavailable, for example `Thu, 31 Dec 2026 23:59:59 GMT`. schema: pattern: >- ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$ type: string X-Request-ID: description: |- Identifier for this HTTP attempt. Application request identifier. schema: type: string X-Trace-ID: description: >- Trace ID of this request. Sent alongside X-Request-ID when a middleware published a trace ID for the request. schema: pattern: ^(?!0{32}$)[0-9a-f]{32}$ type: string '409': content: application/problem+json: schema: $ref: '#/components/schemas/MfaAlreadyEnrolledProblem' description: 'MFA_ALREADY_ENROLLED: MFA Already Enrolled' headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '422': content: application/problem+json: schema: $ref: '#/components/schemas/ValidationFailedProblem' description: 'VALIDATION_FAILED: Request Validation Failed' headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '500': content: application/problem+json: schema: $ref: >- #/components/schemas/BeginTotpEnrollmentInternalServerErrorProblem description: |- INVALID_AUTH_CONTEXT: Invalid Authentication Context INTERNAL_ERROR: Internal Server Error headers: Deprecation: description: >- RFC 9745 structured-field Date at which the operation was or will be deprecated: `@` followed by Unix seconds, for example `@1767225599`. schema: pattern: ^@-?[0-9]+$ type: string Idempotent-Replayed: description: True when this response was replayed from an earlier attempt. schema: type: boolean Link: description: |- Links related to lifecycle or remediation documentation. Optional related resources. schema: type: string RateLimit: description: |- Current rate-limit state. Optional rate limit information. schema: type: string RateLimit-Policy: description: |- Rate-limit policy applied by the gateway. Optional rate limit policy. schema: type: string Retry-After: description: |- Delay before retrying, in seconds or as an HTTP date. Optional retry delay or HTTP date. schema: type: string Sunset: description: >- RFC 8594 HTTP-date (IMF-fixdate) after which the operation may become unavailable, for example `Thu, 31 Dec 2026 23:59:59 GMT`. schema: pattern: >- ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$ type: string X-Request-ID: description: |- Identifier for this HTTP attempt. Application request identifier. schema: type: string X-Trace-ID: description: >- Trace ID of this request. Sent alongside X-Request-ID when a middleware published a trace ID for the request. schema: pattern: ^(?!0{32}$)[0-9a-f]{32}$ type: string '502': content: application/problem+json: schema: $ref: '#/components/schemas/UpstreamFailureProblem' description: 'UPSTREAM_FAILURE: Upstream Service Failure' headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '503': content: application/problem+json: schema: $ref: '#/components/schemas/UpstreamUnavailableProblem' description: 'UPSTREAM_UNAVAILABLE: Upstream Service Unavailable' headers: Deprecation: description: >- RFC 9745 structured-field Date at which the operation was or will be deprecated: `@` followed by Unix seconds, for example `@1767225599`. schema: pattern: ^@-?[0-9]+$ type: string Idempotent-Replayed: description: True when this response was replayed from an earlier attempt. schema: type: boolean Link: description: |- Links related to lifecycle or remediation documentation. Optional related resources. schema: type: string RateLimit: description: |- Current rate-limit state. Optional rate limit information. schema: type: string RateLimit-Policy: description: |- Rate-limit policy applied by the gateway. Optional rate limit policy. schema: type: string Retry-After: description: |- Delay before retrying, in seconds or as an HTTP date. Optional retry delay or HTTP date. schema: type: string Sunset: description: >- RFC 8594 HTTP-date (IMF-fixdate) after which the operation may become unavailable, for example `Thu, 31 Dec 2026 23:59:59 GMT`. schema: pattern: >- ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$ type: string X-Request-ID: description: |- Identifier for this HTTP attempt. Application request identifier. schema: type: string X-Trace-ID: description: >- Trace ID of this request. Sent alongside X-Request-ID when a middleware published a trace ID for the request. schema: pattern: ^(?!0{32}$)[0-9a-f]{32}$ type: string '504': content: application/problem+json: schema: $ref: '#/components/schemas/BeginTotpEnrollmentGatewayTimeoutProblem' description: >- UPSTREAM_TIMEOUT: Upstream Service Timeout; REQUEST_TIMEOUT: Request Timeout headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' security: - accountServiceKey: [] components: schemas: BeginTotpEnrollmentRequest: additionalProperties: false description: >- Empty object. Enrollment uses the authenticated Account and accepts no additional fields. properties: {} type: object BeginTotpEnrollmentResponse: additionalProperties: false properties: enrollmentToken: description: Opaque, short-lived MFA enrollment continuation token. maxLength: 4096 type: string expiresAt: description: >- UTC expiry time of the enrollment token, in RFC 3339 format. Complete verification before this time. example: '2026-01-01T00:00:00.000Z' format: date-time type: string factorId: description: >- Identifier of a TOTP authentication factor, prefixed with auth_factor_. maxLength: 128 pattern: ^auth_factor_[A-Za-z0-9]+$ type: string secret: description: One-time TOTP secret. Never log, cache, or persist it. maxLength: 256 minLength: 1 type: string uri: description: One-time authenticator setup URI containing the TOTP secret. maxLength: 4096 minLength: 1 pattern: ^otpauth:\/\/.* type: string required: - enrollmentToken - expiresAt - factorId - secret - uri type: object NotAuthenticatedProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: NOT_AUTHENTICATED status: 401 title: Not Authenticated type: https://photon.codes/docs/problems/not-authenticated properties: code: const: NOT_AUTHENTICATED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 401 type: number title: const: Not Authenticated type: string type: const: https://photon.codes/docs/problems/not-authenticated type: string required: - code - status - title - type type: object BeginTotpEnrollmentForbiddenProblem: oneOf: - $ref: '#/components/schemas/ForbiddenProblem' - $ref: '#/components/schemas/InsufficientScopeProblem' - $ref: '#/components/schemas/OrganizationSsoRequiredProblem' MfaAlreadyEnrolledProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: MFA_ALREADY_ENROLLED status: 409 title: MFA Already Enrolled type: https://photon.codes/docs/problems/mfa-already-enrolled properties: code: const: MFA_ALREADY_ENROLLED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 409 type: number title: const: MFA Already Enrolled type: string type: const: https://photon.codes/docs/problems/mfa-already-enrolled type: string required: - code - status - title - type type: object ValidationFailedProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: VALIDATION_FAILED issues: - code: invalid_type location: json message: Expected a string. path: /name status: 422 title: Request Validation Failed type: https://photon.codes/docs/problems/validation-failed properties: code: const: VALIDATION_FAILED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string issues: items: $ref: '#/components/schemas/ValidationIssue' type: array remediation: not: {} requestId: minLength: 1 type: string status: const: 422 type: number title: const: Request Validation Failed type: string type: const: https://photon.codes/docs/problems/validation-failed type: string required: - issues - code - status - title - type type: object BeginTotpEnrollmentInternalServerErrorProblem: oneOf: - $ref: '#/components/schemas/InternalErrorProblem' - $ref: '#/components/schemas/InvalidAuthContextProblem' UpstreamFailureProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: UPSTREAM_FAILURE status: 502 title: Upstream Service Failure type: https://photon.codes/docs/problems/upstream-failure properties: code: const: UPSTREAM_FAILURE type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 502 type: number title: const: Upstream Service Failure type: string type: const: https://photon.codes/docs/problems/upstream-failure type: string required: - code - status - title - type type: object UpstreamUnavailableProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: UPSTREAM_UNAVAILABLE status: 503 title: Upstream Service Unavailable type: https://photon.codes/docs/problems/upstream-unavailable properties: code: const: UPSTREAM_UNAVAILABLE type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 503 type: number title: const: Upstream Service Unavailable type: string type: const: https://photon.codes/docs/problems/upstream-unavailable type: string required: - code - status - title - type type: object BeginTotpEnrollmentGatewayTimeoutProblem: oneOf: - $ref: '#/components/schemas/UpstreamTimeoutProblem' - $ref: '#/components/schemas/RequestTimeoutProblem' JsonValue: anyOf: - type: string - type: number - type: boolean - type: 'null' - items: $ref: '#/components/schemas/JsonValue' type: array - additionalProperties: $ref: '#/components/schemas/JsonValue' propertyNames: type: string type: object ForbiddenProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: FORBIDDEN status: 403 title: Forbidden type: https://photon.codes/docs/problems/forbidden properties: code: const: FORBIDDEN type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 403 type: number title: const: Forbidden type: string type: const: https://photon.codes/docs/problems/forbidden type: string required: - code - status - title - type type: object InsufficientScopeProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: INSUFFICIENT_SCOPE status: 403 title: Insufficient Scope type: https://photon.codes/docs/problems/insufficient-scope properties: code: const: INSUFFICIENT_SCOPE type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 403 type: number title: const: Insufficient Scope type: string type: const: https://photon.codes/docs/problems/insufficient-scope type: string required: - code - status - title - type type: object OrganizationSsoRequiredProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: ORGANIZATION_SSO_REQUIRED status: 403 title: Organization SSO Required type: https://photon.codes/docs/problems/organization-sso-required properties: code: const: ORGANIZATION_SSO_REQUIRED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 403 type: number title: const: Organization SSO Required type: string type: const: https://photon.codes/docs/problems/organization-sso-required type: string required: - code - status - title - type type: object ValidationIssue: additionalProperties: false properties: code: minLength: 1 type: string location: $ref: '#/components/schemas/ValidationLocation' message: minLength: 1 type: string path: type: string required: - code - location - message - path type: object InternalErrorProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: INTERNAL_ERROR status: 500 title: Internal Server Error type: https://photon.codes/docs/problems/internal-error properties: code: const: INTERNAL_ERROR type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 500 type: number title: const: Internal Server Error type: string type: const: https://photon.codes/docs/problems/internal-error type: string required: - code - status - title - type type: object InvalidAuthContextProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: INVALID_AUTH_CONTEXT status: 500 title: Invalid Authentication Context type: https://photon.codes/docs/problems/invalid-auth-context properties: code: const: INVALID_AUTH_CONTEXT type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 500 type: number title: const: Invalid Authentication Context type: string type: const: https://photon.codes/docs/problems/invalid-auth-context type: string required: - code - status - title - type type: object UpstreamTimeoutProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: UPSTREAM_TIMEOUT status: 504 title: Upstream Service Timeout type: https://photon.codes/docs/problems/upstream-timeout properties: code: const: UPSTREAM_TIMEOUT type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 504 type: number title: const: Upstream Service Timeout type: string type: const: https://photon.codes/docs/problems/upstream-timeout type: string required: - code - status - title - type type: object RequestTimeoutProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: REQUEST_TIMEOUT status: 504 title: Request Timeout type: https://photon.codes/docs/problems/request-timeout properties: code: const: REQUEST_TIMEOUT type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 504 type: number title: const: Request Timeout type: string type: const: https://photon.codes/docs/problems/request-timeout type: string required: - code - status - title - type type: object ValidationLocation: enum: - body - cookie - form - header - json - param - query type: string headers: Deprecation: description: >- RFC 9745 structured-field Date at which the operation was or will be deprecated: `@` followed by Unix seconds, for example `@1767225599`. schema: pattern: ^@-?[0-9]+$ type: string Idempotent-Replayed: description: True when this response was replayed from an earlier attempt. schema: type: boolean Link: description: Links related to lifecycle or remediation documentation. schema: type: string RateLimit: description: Current rate-limit state. schema: type: string RateLimit-Policy: description: Rate-limit policy applied by the gateway. schema: type: string Retry-After: description: Delay before retrying, in seconds or as an HTTP date. schema: type: string Sunset: description: >- RFC 8594 HTTP-date (IMF-fixdate) after which the operation may become unavailable, for example `Thu, 31 Dec 2026 23:59:59 GMT`. schema: pattern: >- ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$ type: string X-Request-ID: description: Identifier for this HTTP attempt. schema: type: string X-Trace-ID: description: >- Trace ID of this request. Sent alongside X-Request-ID when a middleware published a trace ID for the request. schema: pattern: ^(?!0{32}$)[0-9a-f]{32}$ type: string securitySchemes: accountServiceKey: description: >- Account Service Key, prefixed with `pho_ask_`, sent as `Authorization: Bearer `. Acts on behalf of its owning account, subject to the permissions and credential restrictions of each operation. Account access tokens and OAuth grants also use the Bearer header. In organizations that require SSO, Account Service Keys are not accepted for managing the organization's SSO settings, deleting the organization, or checking whether it can be deleted. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.