post:
  operationId: authMfaGenerateSecret
  tags:
    - Auth MFA
  summary:
    Generate a TOTP secret embedded within a TOTP link for use with an
    authenticator
  description: >-
    For a user who is not currently registered for MFA, generates a secret to
    share with the user's chosen authenticator app. 

    Request requires a unique header as proof of partial authentication called
    'slpt-auth-mfa', and it must contain a special  MFA token for calling this
    endpoint. 

    While no specific right is required for a user to generate a secret, it is
    expected that the caller first verify that  the user is associated with an
    auth profile that has MFA enabled.
  responses:
    "200":
      description:
        Response containing user's username, a newly-generated secret, and a
        TOTP link for a QR code generator to use.
      content:
        application/json:
          schema:
            $ref: "../../schemas/GetSecretResponse.yaml"
    "400":
      $ref: "../../../v3/responses/400.yaml"
    "403":
      $ref: "../../../v3/responses/403.yaml"
    "429":
      $ref: "../../../v3/responses/429.yaml"
    "500":
      $ref: "../../../v3/responses/500.yaml"
