post:
  operationId: authMfaVerifyCode
  tags:
    - Auth MFA
  summary: Validate a TOTP code generated by a user's authenticator
  description: >-
    For a user who is registered for MFA, validates a TOTP code generated by the
    user's authenticator. 

    Request requires a unique header as proof of partial authentication. This
    header is called 'slpt-auth-mfa', and it must contain a special  MFA token
    for calling this endpoint. 

    While no specific right is required for a user to have a TOTP code verified,
    it is assumed that the caller has previously verified that the user is
    associated with an auth profile that has MFA enabled and that the user has
    already registered an authenticator for multi-factor authentication.
  requestBody:
    description: Request body containing TOTP code to validate.
    required: true
    content:
      application/json:
        schema:
          $ref: "../../schemas/TotpCodeRequest.yaml"
  responses:
    "200":
      description: Response indicating that the user's MFA has been verified.
      content:
        application/json:
          schema:
            $ref: "../../schemas/MfaVerificationResponse.yaml"
    "400":
      $ref: "../../../v3/responses/400.yaml"
    "403":
      $ref: "../../../v3/responses/403.yaml"
    "429":
      $ref: "../../../v3/responses/429.yaml"
    "500":
      $ref: "../../../v3/responses/500.yaml"
