`POST /account/mfa/lookups` — the caller's recorded factors. A POST because the step-up token rides the body.
/account/mfa/lookupsRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
The body of the /account/mfa/* calls that carry nothing but the step-up
token. No Debug: a live credential.
Response Body
application/json
curl -X POST "https://example.com/account/mfa/lookups" \ -H "Content-Type: application/json" \ -d '{ "access_token": "string" }'{ "totp_enrolled": true, "webauthn_credentials": [ { "authenticator_attachment": "string", "created_at": "string", "credential_id": "string", "friendly_name": "string", "transports": [ "string" ] } ]}`POST /account/forgot-password`. Unauthenticated. Always returns 202 — the response shape is identical whether the email matches a real user, matches a federated user, or matches nothing. Anti-enumeration is the whole point: callers learn nothing from the response except "we accepted your request". POST
When the email matches a non-federated user, we generate a fresh setup token (the same machinery signup and invitation use) and email the user a `<slug>.<apex>/set-password#<token>` link. Since rh-j4af1x the user's row is **not** touched: this request proves nothing about who sent it, and `POST /account/passwords` accepts the token on the token row rather than on the user's status. Federated users (`provisioned_by.is_some()`) never get a token — their credentials live in their IdP, not in Cognito. Auditing distinguishes every outcome (`sent` / `skipped_federated` / `skipped_unknown` / …) so operators can spot enumeration attempts.
`POST /account/mfa/totp-associations` — begin TOTP enrolment; answers the shared secret. While no factor is recorded it needs the emailed setup token as well as the step-up token — a password alone never enrols a factor. POST
Next Page