MANSOQ Knowledge
← Technical API reference

Backend resource · STATIC DECLARATIONS

TOTP API reference · mansoq-core

Static source contract for TOTP: 4 declared or inherited operation mappings, schema/field evidence and authorization/refusal references. Deployment and behavioral review remain explicit.

Static API contract — behavior review pending. Source baseline f6e9f05f76d4.

Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.

Declared route and availability

This resource is declared in mansoq-core at /api/v1/mfa/totp/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Operation map

Method Path Action Evidence
POST /api/v1/mfa/totp/setup/ setup @action declaration
POST /api/v1/mfa/totp/verify/ verify @action declaration
POST /api/v1/mfa/totp/disable/ disable @action declaration
POST /api/v1/mfa/totp/regenerate_backup_codes/ regenerate_backup_codes @action declaration

setup · POST

POST /api/v1/mfa/totp/setup/ — action setup. static contract extracted; runtime/permission/payload behavior review pending.

decorator responses: TOTPSetupResponse. Declared fields below; inherited fields are retained in the schema inventory.

Field Type Required Constraints
uri str true No extra constraint extracted
secret_key str true No extra constraint extracted

Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.

Declared refusal/error evidence: ValidationError: Two-factor authentication is not enabled for your account; ValidationError: Two-factor authentication is already enabled for your account.

verify · POST

POST /api/v1/mfa/totp/verify/ — action verify. static contract extracted; runtime/permission/payload behavior review pending.

decorator request: TOTPVerifyRequest. Declared fields below; inherited fields are retained in the schema inventory.

Field Type Required Constraints
code str true No extra constraint extracted

decorator responses: TOTPVerifyResponse. Declared fields below; inherited fields are retained in the schema inventory.

Field Type Required Constraints
backup_codes list[str] true No extra constraint extracted

Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.

Explicit response statuses in observed code: status.HTTP_400_BAD_REQUEST. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: TOTP not configured for your account; ValidationError: Two-factor authentication is not enabled for your account; ValidationError: Two-factor authentication is already enabled for your account.

disable · POST

POST /api/v1/mfa/totp/disable/ — action disable. static contract extracted; runtime/permission/payload behavior review pending.

decorator request: PasswordVerifyRequest. Declared fields below; inherited fields are retained in the schema inventory.

Field Type Required Constraints
password str true No extra constraint extracted

Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Two-factor authentication is not enabled for your account; ValidationError: Two-factor authentication is already enabled for your account.

regenerate_backup_codes · POST

POST /api/v1/mfa/totp/regenerate_backup_codes/ — action regenerate_backup_codes. static contract extracted; runtime/permission/payload behavior review pending.

decorator request: PasswordVerifyRequest. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.

Declared refusal/error evidence: ValidationError: Two-factor authentication is not enabled for your account; ValidationError: Two-factor authentication is already enabled for your account.

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.

Pinned source evidence

Links require access to the private source repository.