Add an authenticator app

The own access gets an authenticator app as second factor - with a session only.

WWriteNot idempotentbeta

POST

/v1/access/tfa/totp/createon https://api.manitu.de

Try it

Changes the account. Agents say what will happen and wait for an explicit yes before calling it.

Not offered over MCP - only to programs over REST.

Authentication

One of X-API-Key, Authorization: Bearer … - never more than one in a request. More

Request body JSON; unknown fields are refused

setup_tokenstringrequiredwrite-only

min length 1max length 1024

secretstringrequiredwrite-only

pattern ^[A-Z2-7]{16,128}$

codestringrequiredwrite-only

The code the app shows now.

pattern ^[0-9]{6,8}$

descriptionstring | null

What the customer calls it, e.g. the phone.

max length 1024

is_defaultboolean

The one the sign-in asks for first. Left out: false.

Response in `data`; the rest of the body as on every call

tfa_idintegerrequired

typestringrequired

oath-totp: a code from an authenticator app; fido-u2f: a security key.

One of oath-totp fido-u2f

statusstringrequired

inactive: kept, but not asked for at sign-in.

One of active inactive

descriptionstring | nullrequired

What the customer wrote about it (his description), null if nothing - not its name or user name.

is_defaultbooleanrequired

The one the sign-in asks for first.

created_atstring | nullrequired

Format date-time

Statuses

200Success.400The request does not match the declared input schema.401No credential was presented, or it was not recognised.403The credential is not permitted to use this operation.500The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.503The channel this operation forwards through is unavailable.

POST/v1/access/tfa/totp/create

Request

curl -X POST 'https://api.manitu.de/v1/access/tfa/totp/create' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "setup_token": "eyJwYWdlIjoyfQ",
    "secret": "string",
    "code": "string"
  }'

const response = await fetch('https://api.manitu.de/v1/access/tfa/totp/create', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "setup_token": "eyJwYWdlIjoyfQ",
    "secret": "string",
    "code": "string"
  }),
});
const answer = await response.json();

<?php

$curl = curl_init('https://api.manitu.de/v1/access/tfa/totp/create');

curl_setopt_array($curl, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => [
        'X-API-Key: ' . getenv('API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => '{"setup_token":"eyJwYWdlIjoyfQ","secret":"string","code":"string"}',
    CURLOPT_RETURNTRANSFER => true,
]);

$answer = json_decode(curl_exec($curl), true);

import os

import requests

response = requests.request(
    "POST",
    "https://api.manitu.de/v1/access/tfa/totp/create",
    headers={"X-API-Key": os.environ["API_KEY"]},
    json={
        "setup_token": "eyJwYWdlIjoyfQ",
        "secret": "string",
        "code": "string",
    },
)
answer = response.json()

Response 200

{
  "status": {
    "type": "success",
    "code": 200
  },
  "meta": {},
  "data": {
    "tfa_id": 12345,
    "type": "oath-totp",
    "status": "active",
    "description": "Example",
    "is_default": true,
    "created_at": "2026-10-23T12:00:00+02:00"
  }
}

Add an authenticator app

Authentication

Request body JSON; unknown fields are refused

Response in data; the rest of the body as on every call

Statuses

Response in `data`; the rest of the body as on every call