--- updatedAt: 2026-06-04T19:58:43.000Z agentTools: projectIndex: https://docs.wristband.dev/llms.txt --- # Verify TOTP Auth Factor Challenge Verifies the TOTP auth factor challenge. ### Required Permissions Below is the list of required permissions needed to interact with this API. For each permission, the allowed permission boundaries are also specified. | Permission | Boundary | Description | | ------------------------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **totp-auth-factor:verify-challenge** | Application | The subject can perform this operation if the user specified in the request is associated with the subject's application. | | | Tenant | The subject can perform this operation if the user specified in the request belongs to the subject's associated tenant. | | | Tenant Inclusion List | The subject can perform this operation if the user specified in the request belongs to a tenant in the tenant inclusion list. | | | Tenant Exclusion List | The subject can perform this operation if the user specified in the request belongs to the subject's associated application but does not belong to a tenant in the tenant exclusion list. | | | Self | The subject can perform this operation if the user specified in the request is the subject itself. | # OpenAPI definition ```json { "openapi": "3.1.0", "info": { "title": "Resource Management APIs", "version": "1.0.0", "description": "Resource Management APIs", "license": { "name": "Private", "url": "https://wristband.dev/terms/" }, "termsOfService": "https://wristband.dev/terms/", "contact": { "name": "Wristband Support", "email": "support@wristband.dev", "url": "https://wristband.dev/contact/" } }, "servers": [ { "url": "https://{application_vanity_domain}", "description": "Wristband application scoped URL.", "variables": { "application_vanity_domain": { "default": "yourapp-yourorg.us.wristband.dev", "description": "Wristband vanity domain scoped to a specific application." } } } ], "tags": [ { "name": "Auth Factors", "description": "Auth Factors", "x-displayName": "Auth Factors" } ], "paths": { "/api/v1/auth-factors/totp/verify-challenge": { "post": { "summary": "Verify TOTP Auth Factor Challenge", "operationId": "verifyTotpAuthFactorChallengeV1", "tags": [ "Auth Factors" ], "requestBody": { "description": "Verify Auth Factor Challenge Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_VerifyAuthFactorChallengeRequest" }, "examples": { "Example 1": { "$ref": "#/components/examples/Resource_Management_APIs_VerifyAuthFactorChallengeRequestExample" } } } } }, "responses": { "204": { "$ref": "#/components/responses/Resource_Management_APIs_204" }, "400": { "$ref": "#/components/responses/Resource_Management_APIs_400-with-message-body" }, "401": { "$ref": "#/components/responses/Resource_Management_APIs_401" }, "403": { "$ref": "#/components/responses/Resource_Management_APIs_403" }, "405": { "$ref": "#/components/responses/Resource_Management_APIs_405" }, "406": { "$ref": "#/components/responses/Resource_Management_APIs_406" }, "415": { "$ref": "#/components/responses/Resource_Management_APIs_415" }, "500": { "$ref": "#/components/responses/Resource_Management_APIs_500" }, "503": { "$ref": "#/components/responses/Resource_Management_APIs_503" } }, "security": [ { "Resource_Management_APIs_BearerAuth": [] } ] } } }, "components": { "securitySchemes": { "Resource_Management_APIs_BearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" } }, "schemas": { "Resource_Management_APIs_api-error": { "title": "ApiError", "type": "object", "description": "API error object", "x-examples": { "Example 1": { "code": "invalid_request", "message": "The request was invalid", "ticket": "11t7n71hi5e6t" } }, "properties": { "type": { "type": "string", "example": "base_error", "minLength": 1, "description": "The type of the API error.", "readOnly": true }, "code": { "type": "string", "example": "invalid_request", "minLength": 1, "description": "A code identifying the error that occurred.", "readOnly": true }, "message": { "type": "string", "example": "The request was invalid", "description": "A free text message describing the error. This error message is only meant to help developers understand the cause of the error. It should not be used for programmatic purposes.", "readOnly": true }, "ticket": { "type": "string", "example": "11t7n71hi5e6t", "description": "Ticket that can help correlate the error to the backend", "readOnly": true }, "details": { "type": "object", "description": "A map of details about the error. The keys are defined by the API.", "additionalProperties": {}, "example": { "attemptsRemaining": 4 } } }, "required": [ "type", "code" ] }, "Resource_Management_APIs_constraint-violations-api-error": { "title": "ConstraintViolationsApiError", "description": "An API error that occurred due to a constraint violation", "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, { "type": "object", "readOnly": true, "required": [ "violations" ], "properties": { "violations": { "type": "object", "readOnly": true, "required": [ "code" ], "properties": { "code": { "type": "string", "description": "A code identifying the constraint violation.", "minLength": 1, "example": "too_long" }, "constraintAttributes": { "type": "object", "description": "A map of constraint attribute values.", "additionalProperties": { "type": "string" }, "example": { "maxLength": "10" } } } } } } ], "x-examples": { "Example 1": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The request contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": "10" } }, "field2": { "code": "not_null" } } } } }, "Resource_Management_APIs_VerifyAuthFactorChallengeRequest": { "title": "Verify Auth Factor Challenge Request", "type": "object", "description": "Verify Auth Factor Challenge Request", "required": [ "userId", "code" ], "x-tags": [ "Models" ], "properties": { "userId": { "description": "The ID of the user that the auth factor is associated to.", "type": "string", "minLength": 1, "maxLength": 26, "example": "pl4a4aa4jzydksmrf3jnu5yfcw" }, "code": { "description": "The code that will be used to verify the auth factor challenge.", "type": "string", "minLength": 1, "example": 123456 } }, "example": { "userId": "pl4a4aa4jzydksmrf3jnu5yfcw", "code": 123456 } } }, "examples": { "Resource_Management_APIs_VerifyAuthFactorChallengeRequestExample": { "description": "Verify Auth Factor Challenge Request JSON object.", "value": { "userId": "pl4a4aa4jzydksmrf3jnu5yfcw", "code": 123456 } } }, "responses": { "Resource_Management_APIs_204": { "description": "No Content" }, "Resource_Management_APIs_401": { "description": "Unauthorized", "headers": { "WWW-Authenticate": { "description": "Includes details on the failed authentication condition. This header is set in accordance with the [OAuth2 specification](https://datatracker.ietf.org/doc/html/rfc6750#section-3).", "schema": { "type": "string", "example": "Bearer error=\"invalid_token\", error_description=\"The provided access token was invalid\"" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unauthenticated": { "value": { "type": "base_error", "code": "invalid_access_token", "message": "The provided access token was invalid", "ticket": "1u0d0edhwbjsd" } } } } } }, "Resource_Management_APIs_403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unauthorized": { "value": { "type": "base_error", "code": "unauthorized", "message": "The request failed authorization", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_405": { "description": "Method Not Allowed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - method_not_supported": { "value": { "type": "base_error", "code": "method_not_supported", "message": "The specified HTTP method is not supported", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_406": { "description": "Not Acceptable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - not_acceptable": { "value": { "type": "base_error", "code": "not_acceptable", "message": "The Accept header was invalid", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unsupported_media_type": { "value": { "type": "base_error", "code": "unsupported_media_type", "message": "The Content-Type header was invalid", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - internal_server_failure ": { "value": { "type": "base_error", "code": "internal_server_failure", "message": "An unexpected error occurred while processing the request", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - service_unavailable": { "value": { "type": "base_error", "code": "service_unavailable", "message": "The service is currently unavailable", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_400-with-message-body": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, { "$ref": "#/components/schemas/Resource_Management_APIs_constraint-violations-api-error" } ] }, "examples": { "code - invalid_request": { "value": { "type": "base_error", "code": "invalid_request", "message": "The request was invalid", "ticket": "11t7n71hi5e6t" } }, "code - request_constraint_violations": { "value": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The message body contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": 10 } }, "field2": { "code": "not_null" } } } }, "code - message_body_constraint_violations": { "value": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The message body contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": 10 } }, "field2": { "code": "not_null" } } } } } } } } } }, "x-tagGroups": [ { "name": "Resource Management APIs", "tags": [ "Applications", "Auth Factors", "Auth Sessions", "Auth Session Policies", "Bot Detection Policies", "Custom Claims", "Custom Domains", "Email Brandings", "Email Domains", "Email Policies", "External IdP Profiles", "External IdP Tokens", "Identity Providers", "IdP Attribute Mappings", "IdP Role Mappings", "MFA Policies", "OAuth2 Clients", "Page Brandings", "Password Policies", "Permissions", "Permission Boundaries", "Permission Groups", "Refresh Tokens", "Remembered Tenants", "Roles", "Role Assignment Policies", "Signing Keys", "Tenants", "Users", "User Schemas", "Vanity Domains", "Webhook Policies", "Workflow Policies" ] } ] } ```