POST /mfa/challenge

Create a one-time MFA challenge code for a specified user, supporting SMS, email, TOTP, push, and other verification methods, used for secondary authentication before login or sensitive operations. Reference: NIST SP 800-63B §5.1.7 (Verifier Impersonation Resistance), OWASP ASVS V2.8.

Request Body

Schema: dto.MFAChallengeRequest

Field	Type	Required	Example	Constraints	Description
method	string	Yes	sms

Responses

Status	Description	Schema
201	Challenge code created successfully	dto.MFAChallengeDetailResponse
400	Invalid parameter	gitee_com_linmes_authms_base_dto.SimpleResponse
401	Unauthenticated	gitee_com_linmes_authms_base_dto.SimpleResponse
404	Challenge not found	gitee_com_linmes_authms_base_dto.SimpleResponse
429	Request too frequent	gitee_com_linmes_authms_base_dto.SimpleResponse
500	Internal server error	gitee_com_linmes_authms_base_dto.SimpleResponse

Referenced Schemas

dto.MFAChallengeDetailResponse

Field	Type	Required	Example	Constraints	Description
code	integer	No
data	dto.MFAChallengeResponse	No
message	string	No
timestamp	string	No

dto.MFAChallengeResponse

Field	Type	Required	Example	Constraints	Description
challenge_id	string	No	challenge-1234567890
created_at	string	No	2026-04-14T12:00:00Z
expires_in	integer	No	300
method	string	No	sms
tenant_id	string	No	tenant-001
user_id	string	No	user-001

gitee_com_linmes_authms_base_dto.SimpleResponse

Field	Type	Required	Example	Constraints	Description
code	integer	No
message	string	No
timestamp	string	No