> ## Documentation Index > Fetch the complete documentation index at: https://docs.photon.codes/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use Stable documentation by default. Honor an explicit Beta request or a URL under /docs/beta/. If the requested version conflicts with the installed CLI package or API origin, clarify the target before writing integration code. > Pages under /docs/beta/ document Beta; other product pages document Stable. Keep the CLI package, commands, API origin, and credentials within the selected version. State the documentation version in your answer. > For MCP search, always pass version: Stable or version: Beta. Unfiltered search mixes both versions. For filesystem reads, keep Beta queries under /beta/ and exclude /beta/ from Stable queries; discover paths before reading them. > The public docs base is https://photon.codes/docs. Convert MCP page paths to public URLs under that base, preserving /beta/ when present. Read https://photon.codes/docs/skill.md for version selection and https://photon.codes/docs/llms.txt for the version indexes. # Verify TOTP enrollment > Requires a first-party interactive Account credential authenticated no more than 300 seconds ago. ## OpenAPI ````yaml https://api.photon.codes/openapi.json post /v1/account/security/mfa/totp/verify openapi: 3.1.0 info: title: Photon API version: 1.0.0 servers: - url: https://api.photon.codes security: [] paths: /v1/account/security/mfa/totp/verify: post: tags: - Account MFA summary: Verify TOTP enrollment description: >- Requires a first-party interactive Account credential authenticated no more than 300 seconds ago. operationId: verifyTotpEnrollment parameters: [] requestBody: content: application/json: schema: $ref: '#/components/schemas/VerifyTotpEnrollmentRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/VerifyTotpEnrollmentResponse' description: The TOTP factor was verified for the authenticated Account. headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/MfaEnrollmentInvalidProblem' description: 'MFA_ENROLLMENT_INVALID: MFA Enrollment Invalid' headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/NotAuthenticatedProblem' description: 'NOT_AUTHENTICATED: Not Authenticated' headers: Link: description: Optional related resources. schema: type: string RateLimit: description: Optional rate limit information. schema: type: string RateLimit-Policy: description: Optional rate limit policy. schema: type: string Retry-After: description: Optional retry delay or HTTP date. schema: type: string WWW-Authenticate: required: true schema: type: string X-Request-ID: description: Application request identifier. schema: type: string '403': content: application/problem+json: schema: $ref: '#/components/schemas/VerifyTotpEnrollmentForbiddenProblem' description: >- FORBIDDEN: Forbidden FORBIDDEN: Forbidden; INSUFFICIENT_SCOPE: Insufficient Scope; ORGANIZATION_SSO_REQUIRED: Organization SSO Required headers: Deprecation: description: >- RFC 9745 structured-field Date at which the operation was or will be deprecated: `@` followed by Unix seconds, for example `@1767225599`. schema: pattern: ^@-?[0-9]+$ type: string Idempotent-Replayed: description: True when this response was replayed from an earlier attempt. schema: type: boolean Link: description: |- Links related to lifecycle or remediation documentation. Optional related resources. schema: type: string RateLimit: description: |- Current rate-limit state. Optional rate limit information. schema: type: string RateLimit-Policy: description: |- Rate-limit policy applied by the gateway. Optional rate limit policy. schema: type: string Retry-After: description: |- Delay before retrying, in seconds or as an HTTP date. Optional retry delay or HTTP date. schema: type: string Sunset: description: >- RFC 8594 HTTP-date (IMF-fixdate) after which the operation may become unavailable, for example `Thu, 31 Dec 2026 23:59:59 GMT`. schema: pattern: >- ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$ type: string X-Request-ID: description: |- Identifier for this HTTP attempt. Application request identifier. schema: type: string X-Trace-ID: description: >- Trace ID of this request. Sent alongside X-Request-ID when a middleware published a trace ID for the request. schema: pattern: ^(?!0{32}$)[0-9a-f]{32}$ type: string '410': content: application/problem+json: schema: $ref: '#/components/schemas/MfaEnrollmentExpiredProblem' description: 'MFA_ENROLLMENT_EXPIRED: MFA Enrollment Expired' headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '422': content: application/problem+json: schema: $ref: >- #/components/schemas/VerifyTotpEnrollmentUnprocessableEntityProblem description: >- VALIDATION_FAILED: Request Validation Failed; MFA_VERIFICATION_FAILED: MFA Verification Failed headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '500': content: application/problem+json: schema: $ref: >- #/components/schemas/VerifyTotpEnrollmentInternalServerErrorProblem description: |- INVALID_AUTH_CONTEXT: Invalid Authentication Context INTERNAL_ERROR: Internal Server Error headers: Deprecation: description: >- RFC 9745 structured-field Date at which the operation was or will be deprecated: `@` followed by Unix seconds, for example `@1767225599`. schema: pattern: ^@-?[0-9]+$ type: string Idempotent-Replayed: description: True when this response was replayed from an earlier attempt. schema: type: boolean Link: description: |- Links related to lifecycle or remediation documentation. Optional related resources. schema: type: string RateLimit: description: |- Current rate-limit state. Optional rate limit information. schema: type: string RateLimit-Policy: description: |- Rate-limit policy applied by the gateway. Optional rate limit policy. schema: type: string Retry-After: description: |- Delay before retrying, in seconds or as an HTTP date. Optional retry delay or HTTP date. schema: type: string Sunset: description: >- RFC 8594 HTTP-date (IMF-fixdate) after which the operation may become unavailable, for example `Thu, 31 Dec 2026 23:59:59 GMT`. schema: pattern: >- ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$ type: string X-Request-ID: description: |- Identifier for this HTTP attempt. Application request identifier. schema: type: string X-Trace-ID: description: >- Trace ID of this request. Sent alongside X-Request-ID when a middleware published a trace ID for the request. schema: pattern: ^(?!0{32}$)[0-9a-f]{32}$ type: string '502': content: application/problem+json: schema: $ref: '#/components/schemas/UpstreamFailureProblem' description: 'UPSTREAM_FAILURE: Upstream Service Failure' headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' '503': content: application/problem+json: schema: $ref: '#/components/schemas/UpstreamUnavailableProblem' description: 'UPSTREAM_UNAVAILABLE: Upstream Service Unavailable' headers: Deprecation: description: >- RFC 9745 structured-field Date at which the operation was or will be deprecated: `@` followed by Unix seconds, for example `@1767225599`. schema: pattern: ^@-?[0-9]+$ type: string Idempotent-Replayed: description: True when this response was replayed from an earlier attempt. schema: type: boolean Link: description: |- Links related to lifecycle or remediation documentation. Optional related resources. schema: type: string RateLimit: description: |- Current rate-limit state. Optional rate limit information. schema: type: string RateLimit-Policy: description: |- Rate-limit policy applied by the gateway. Optional rate limit policy. schema: type: string Retry-After: description: |- Delay before retrying, in seconds or as an HTTP date. Optional retry delay or HTTP date. schema: type: string Sunset: description: >- RFC 8594 HTTP-date (IMF-fixdate) after which the operation may become unavailable, for example `Thu, 31 Dec 2026 23:59:59 GMT`. schema: pattern: >- ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$ type: string X-Request-ID: description: |- Identifier for this HTTP attempt. Application request identifier. schema: type: string X-Trace-ID: description: >- Trace ID of this request. Sent alongside X-Request-ID when a middleware published a trace ID for the request. schema: pattern: ^(?!0{32}$)[0-9a-f]{32}$ type: string '504': content: application/problem+json: schema: $ref: '#/components/schemas/VerifyTotpEnrollmentGatewayTimeoutProblem' description: >- UPSTREAM_TIMEOUT: Upstream Service Timeout; REQUEST_TIMEOUT: Request Timeout headers: Deprecation: $ref: '#/components/headers/Deprecation' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' Link: $ref: '#/components/headers/Link' RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' Sunset: $ref: '#/components/headers/Sunset' X-Request-ID: $ref: '#/components/headers/X-Request-ID' X-Trace-ID: $ref: '#/components/headers/X-Trace-ID' security: - accountServiceKey: [] components: schemas: VerifyTotpEnrollmentRequest: additionalProperties: false properties: enrollmentToken: description: >- Opaque enrollmentToken returned by begin TOTP enrollment. Submit it before expiresAt. maxLength: 4096 minLength: 1 type: string verificationCode: description: >- Six-digit code from the authenticator configured with the enrollment secret. Send as a string to preserve leading zeros. pattern: ^[0-9]{6}$ type: string required: - enrollmentToken - verificationCode type: object VerifyTotpEnrollmentResponse: additionalProperties: false properties: enrolled: const: true description: >- Always true after the TOTP factor has been successfully verified and enrolled. type: boolean factorId: description: >- Identifier of a TOTP authentication factor, prefixed with auth_factor_. maxLength: 128 pattern: ^auth_factor_[A-Za-z0-9]+$ type: string required: - enrolled - factorId type: object MfaEnrollmentInvalidProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: MFA_ENROLLMENT_INVALID status: 400 title: MFA Enrollment Invalid type: https://photon.codes/docs/problems/mfa-enrollment-invalid properties: code: const: MFA_ENROLLMENT_INVALID type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 400 type: number title: const: MFA Enrollment Invalid type: string type: const: https://photon.codes/docs/problems/mfa-enrollment-invalid type: string required: - code - status - title - type type: object NotAuthenticatedProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: NOT_AUTHENTICATED status: 401 title: Not Authenticated type: https://photon.codes/docs/problems/not-authenticated properties: code: const: NOT_AUTHENTICATED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 401 type: number title: const: Not Authenticated type: string type: const: https://photon.codes/docs/problems/not-authenticated type: string required: - code - status - title - type type: object VerifyTotpEnrollmentForbiddenProblem: oneOf: - $ref: '#/components/schemas/ForbiddenProblem' - $ref: '#/components/schemas/InsufficientScopeProblem' - $ref: '#/components/schemas/OrganizationSsoRequiredProblem' MfaEnrollmentExpiredProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: MFA_ENROLLMENT_EXPIRED status: 410 title: MFA Enrollment Expired type: https://photon.codes/docs/problems/mfa-enrollment-expired properties: code: const: MFA_ENROLLMENT_EXPIRED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 410 type: number title: const: MFA Enrollment Expired type: string type: const: https://photon.codes/docs/problems/mfa-enrollment-expired type: string required: - code - status - title - type type: object VerifyTotpEnrollmentUnprocessableEntityProblem: oneOf: - $ref: '#/components/schemas/ValidationFailedProblem' - $ref: '#/components/schemas/MfaVerificationFailedProblem' VerifyTotpEnrollmentInternalServerErrorProblem: oneOf: - $ref: '#/components/schemas/InternalErrorProblem' - $ref: '#/components/schemas/InvalidAuthContextProblem' UpstreamFailureProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: UPSTREAM_FAILURE status: 502 title: Upstream Service Failure type: https://photon.codes/docs/problems/upstream-failure properties: code: const: UPSTREAM_FAILURE type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 502 type: number title: const: Upstream Service Failure type: string type: const: https://photon.codes/docs/problems/upstream-failure type: string required: - code - status - title - type type: object UpstreamUnavailableProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: UPSTREAM_UNAVAILABLE status: 503 title: Upstream Service Unavailable type: https://photon.codes/docs/problems/upstream-unavailable properties: code: const: UPSTREAM_UNAVAILABLE type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 503 type: number title: const: Upstream Service Unavailable type: string type: const: https://photon.codes/docs/problems/upstream-unavailable type: string required: - code - status - title - type type: object VerifyTotpEnrollmentGatewayTimeoutProblem: oneOf: - $ref: '#/components/schemas/UpstreamTimeoutProblem' - $ref: '#/components/schemas/RequestTimeoutProblem' JsonValue: anyOf: - type: string - type: number - type: boolean - type: 'null' - items: $ref: '#/components/schemas/JsonValue' type: array - additionalProperties: $ref: '#/components/schemas/JsonValue' propertyNames: type: string type: object ForbiddenProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: FORBIDDEN status: 403 title: Forbidden type: https://photon.codes/docs/problems/forbidden properties: code: const: FORBIDDEN type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 403 type: number title: const: Forbidden type: string type: const: https://photon.codes/docs/problems/forbidden type: string required: - code - status - title - type type: object InsufficientScopeProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: INSUFFICIENT_SCOPE status: 403 title: Insufficient Scope type: https://photon.codes/docs/problems/insufficient-scope properties: code: const: INSUFFICIENT_SCOPE type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 403 type: number title: const: Insufficient Scope type: string type: const: https://photon.codes/docs/problems/insufficient-scope type: string required: - code - status - title - type type: object OrganizationSsoRequiredProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: ORGANIZATION_SSO_REQUIRED status: 403 title: Organization SSO Required type: https://photon.codes/docs/problems/organization-sso-required properties: code: const: ORGANIZATION_SSO_REQUIRED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 403 type: number title: const: Organization SSO Required type: string type: const: https://photon.codes/docs/problems/organization-sso-required type: string required: - code - status - title - type type: object ValidationFailedProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: VALIDATION_FAILED issues: - code: invalid_type location: json message: Expected a string. path: /name status: 422 title: Request Validation Failed type: https://photon.codes/docs/problems/validation-failed properties: code: const: VALIDATION_FAILED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string issues: items: $ref: '#/components/schemas/ValidationIssue' type: array remediation: not: {} requestId: minLength: 1 type: string status: const: 422 type: number title: const: Request Validation Failed type: string type: const: https://photon.codes/docs/problems/validation-failed type: string required: - issues - code - status - title - type type: object MfaVerificationFailedProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: MFA_VERIFICATION_FAILED status: 422 title: MFA Verification Failed type: https://photon.codes/docs/problems/mfa-verification-failed properties: code: const: MFA_VERIFICATION_FAILED type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 422 type: number title: const: MFA Verification Failed type: string type: const: https://photon.codes/docs/problems/mfa-verification-failed type: string required: - code - status - title - type type: object InternalErrorProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: INTERNAL_ERROR status: 500 title: Internal Server Error type: https://photon.codes/docs/problems/internal-error properties: code: const: INTERNAL_ERROR type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 500 type: number title: const: Internal Server Error type: string type: const: https://photon.codes/docs/problems/internal-error type: string required: - code - status - title - type type: object InvalidAuthContextProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: INVALID_AUTH_CONTEXT status: 500 title: Invalid Authentication Context type: https://photon.codes/docs/problems/invalid-auth-context properties: code: const: INVALID_AUTH_CONTEXT type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 500 type: number title: const: Invalid Authentication Context type: string type: const: https://photon.codes/docs/problems/invalid-auth-context type: string required: - code - status - title - type type: object UpstreamTimeoutProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: UPSTREAM_TIMEOUT status: 504 title: Upstream Service Timeout type: https://photon.codes/docs/problems/upstream-timeout properties: code: const: UPSTREAM_TIMEOUT type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 504 type: number title: const: Upstream Service Timeout type: string type: const: https://photon.codes/docs/problems/upstream-timeout type: string required: - code - status - title - type type: object RequestTimeoutProblem: additionalProperties: $ref: '#/components/schemas/JsonValue' example: code: REQUEST_TIMEOUT status: 504 title: Request Timeout type: https://photon.codes/docs/problems/request-timeout properties: code: const: REQUEST_TIMEOUT type: string detail: minLength: 1 type: string instance: minLength: 1 type: string remediation: not: {} requestId: minLength: 1 type: string status: const: 504 type: number title: const: Request Timeout type: string type: const: https://photon.codes/docs/problems/request-timeout type: string required: - code - status - title - type type: object ValidationIssue: additionalProperties: false properties: code: minLength: 1 type: string location: $ref: '#/components/schemas/ValidationLocation' message: minLength: 1 type: string path: type: string required: - code - location - message - path type: object ValidationLocation: enum: - body - cookie - form - header - json - param - query type: string headers: Deprecation: description: >- RFC 9745 structured-field Date at which the operation was or will be deprecated: `@` followed by Unix seconds, for example `@1767225599`. schema: pattern: ^@-?[0-9]+$ type: string Idempotent-Replayed: description: True when this response was replayed from an earlier attempt. schema: type: boolean Link: description: Links related to lifecycle or remediation documentation. schema: type: string RateLimit: description: Current rate-limit state. schema: type: string RateLimit-Policy: description: Rate-limit policy applied by the gateway. schema: type: string Retry-After: description: Delay before retrying, in seconds or as an HTTP date. schema: type: string Sunset: description: >- RFC 8594 HTTP-date (IMF-fixdate) after which the operation may become unavailable, for example `Thu, 31 Dec 2026 23:59:59 GMT`. schema: pattern: >- ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$ type: string X-Request-ID: description: Identifier for this HTTP attempt. schema: type: string X-Trace-ID: description: >- Trace ID of this request. Sent alongside X-Request-ID when a middleware published a trace ID for the request. schema: pattern: ^(?!0{32}$)[0-9a-f]{32}$ type: string securitySchemes: accountServiceKey: description: >- Account Service Key, prefixed with `pho_ask_`, sent as `Authorization: Bearer `. Acts on behalf of its owning account, subject to the permissions and credential restrictions of each operation. Account access tokens and OAuth grants also use the Bearer header. In organizations that require SSO, Account Service Keys are not accepted for managing the organization's SSO settings, deleting the organization, or checking whether it can be deleted. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.