Confirm a two-factor login

Finishes a password sign-in that returned HTTP 202 from Log in, using the code emailed to the user.

two_fa_otp must match two_fa_session_id (case-insensitive, surrounding spaces ignored).

The code expires 5 minutes after it is sent and can only be used once.

On success, 2FA stays active, a new grace period starts (two_fa.refreshed_limit_date) and the sign-in counts toward the daily limit.

This endpoint is public.

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

Responses

🟢200Signed in

application/json

Signed in.

Bodyapplication/json

Example

{
    "user": {
        "_id": "65f1c2a9e4b0a1b2c3d4e5f6",
        "firstname": "Ana",
        "lastname": "López",
        "email": "ana.lopez@example.com",
        "password": "$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy",
        "devices": [],
        "dc_access": {
            "_id": "65f1c2a9e4b0a1b2c3d4e5c3",
            "days": [
                1,
                2,
                3,
                4,
                5
            ],
            "from": "08:00",
            "to": "20:00",
            "locations": [
                {
                    "_id": "65f1c2a9e4b0a1b2c3d4e602",
                    "datacenter": "MEX1",
                    "status": true,
                    "fases": [
                        "F1"
                    ]
                }
            ],
            "datacenters": [
                "65f1c2a9e4b0a1b2c3d4e5d4"
            ],
            "_business": "65f1c2a9e4b0a1b2c3d4e5a1",
            "_business_user": "65f1c2a9e4b0a1b2c3d4e5f6",
            "_authorized_business_user": "65f1c2a9e4b0a1b2c3d4e5f6",
            "request_date": "2025-01-10T16:00:00.000Z",
            "authorized_date": "2025-01-11T09:30:00.000Z",
            "status": "Autorizada",
            "authorizer_name": "Ana López",
            "authorizer_email": "ana.lopez@example.com",
            "__v": 0
        },
        "device_tokens": [],
        "consoles": [],
        "active": true,
        "role": {
            "_id": "65f1c2a9e4b0a1b2c3d4e5b2",
            "name": "Administrador",
            "slug": "admin",
            "show_in_releases": true,
            "__v": 0
        },
        "business": {
            "_id": "65f1c2a9e4b0a1b2c3d4e5a1",
            "name": "Digital Ignition",
            "normalized_name": "digital ignition",
            "calle": "Av. Prolongación Paseo de la Reforma 5287",
            "colonia": "Cuajimalpa",
            "municipio": "Cuajimalpa de Morelos",
            "estado": "Ciudad de México",
            "pais": "México",
            "cp": "05000",
            "tel": "5550000000",
            "id_salesforce": "0015e00000AbCdEAAV",
            "admin": "65f1c2a9e4b0a1b2c3d4e5f6",
            "active": 1,
            "traffic_light": false,
            "extradata": [],
            "datacenters": [
                {
                    "_id": "65f1c2a9e4b0a1b2c3d4e601",
                    "datacenter": "MEX1",
                    "status": true,
                    "fases": [
                        "F1",
                        "F2"
                    ]
                }
            ],
            "created_at": "2024-03-13T18:22:01.000Z",
            "ejecutivo_finanzas": "finanzas@kio.tech",
            "ejecutivo_finanzas_backup": "",
            "preauthorization": false,
            "_report_business_user": [
                "65f1c2a9e4b0a1b2c3d4e5f6"
            ],
            "_report_kio_user": [],
            "language_report": "es",
            "business_channel": false,
            "business_main": null,
            "qrform": false,
            "has_drwp": false,
            "is_kio_business": false,
            "is_xc_active": true,
            "is_ic_active": false,
            "__v": 0
        },
        "created_at": "2024-03-13T18:22:01.000Z",
        "level": "Administrador",
        "show_in_releases": true,
        "show_in_alerts": true,
        "time_zone": "America/Mexico_City",
        "verify_email": "deliverable",
        "delete_request": false,
        "id_service_desk_plus": "0",
        "two_factor_auth_activated": true,
        "two_factor_auth_limit_date": "04-11-2026",
        "two_factor_auth_unavailable": false,
        "password_limit_date": "2027-01-03T19:00:00.000Z",
        "sent_feedback": false,
        "__v": 0
    },
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJfaWQiOiI2NWYxYzJhOWU0YjBhMWIyYzNkNGU1ZjYifQ.c2lnbmF0dXJl",
    "permissions": [
        "xc-requests",
        "kiolink-events"
    ],
    "two_fa": {
        "required": false,
        "verified": true,
        "refreshed_limit_date": "04-11-2026",
        "grace_days_config": 30
    }
}

🟠400A field is missing, or the code does not match the session

🟠404The 2FA session does not exist, was already used or expired,

🟠405The user's business is inactive

🔴500Unexpected error