Verify TOTP code

POST /v1/security/totp/verify

Deprecated. Still served for existing callers. Avoid it in new integrations.

Checks a 6-digit code against the account's current secret and changes nothing. The Settings panel no longer calls it: every action that needs proof of the code (enable, disable, unbind, settings) validates it as part of the write, which is one round trip instead of two and cannot drift between the check and the change. Kept for callers outside this repo that already integrated against it.

Request body

{ "totpCode": "123456" }

Response body

{ "success": true }

Notes

Failures answer with { error, status, message }, where error is the stable machine code. A rejected second factor maps to one of a stable set: invalid_totp, totp_required, invalid_email_code, email_code_required, verification_locked (too many wrong email codes; the message names the wait), totp_state_conflict (the account is already in the requested state), totp_not_provisioned (no secret generated yet), or rate_limited. Request-shape rejections answer 400 with totp_code_required, totp_and_email_required, or settings_payload_invalid depending on the endpoint. Anything the gateway cannot classify keeps that endpoint's own <action>_failed code with a generic message; the upstream wording stays in the server log.