post:
  operationId: authMfaGenerateMfaToken
  tags:
    - Auth MFA
  summary: Generate a special token for calling sp-mfa /totp/** APIs
  description: >-
    Generates an MFA token and establishes an unverified MFA-on-login context state. </br>
    Callable by either an internal service or an authenticated user. </br>
    </br>
    When called by an internal service, the calling service must present the target user's external id as the <code>requestedFor</code> value. </br>
    </br>
    When called by an authenticated user, the proxying service must present "me" as the the <code>requestedFor</code> value. </br>
    </br>
    The following rights are required to access this endpoint: <code>sp:mfa-token-all:create</code>, <code>sp:mfa-token-self:create</code> </br>
    </br>
    If an external id is presented as the request body's <code>requestedFor</code> value, the caller must possess the <code>sp:mfa-token-all:create</code> right. </br>
    </br>
    This implies that an internal service is obtaining an MFA token on behalf of a user.
  requestBody:
    description: Request body containing <code>requestedFor</code> value.
    required: true
    content:
      application/json:
        schema:
          $ref: '../../schemas/GetMfaTokenRequest.yaml'
  responses:
    '200':
      description: Response containing an MFA Token.
      content:
        application/json:
          schema:
            $ref: '../../schemas/GetMfaTokenResponse.yaml'
    '400':
      $ref: '../../../v3/responses/400.yaml'
    '401':
      $ref: '../../../v3/responses/401.yaml'
    '403':
      $ref: '../../../v3/responses/403.yaml'
    '404':
      $ref: '../../../v3/responses/404.yaml'
    '429':
      $ref: '../../../v3/responses/429.yaml'
    '500':
      $ref: '../../../v3/responses/500.yaml'
