POST `/internal/mfa/totp/validate`

Internal verify user TOTP code without JWT authentication, called by other services (identity-service) during login. Requires InternalAPIKey authentication. Reference: RFC 6238 (TOTP), OWASP ASVS V2.8.3.

Multi-Factor Authentication None application/json

Request Body

Schema: dto.InternalTOTPValidateRequest

Field	Type	Required
`code`	`string`	Yes
`user_id`	`string`	Yes
`tenant_id`	`string`	No

Responses

Status	Description	Schema
200	Verification result	`dto.ValidDetailResponse`
400	Invalid parameter	`gitee_com_linmes_authms_base_dto.SimpleResponse`
401	Missing internal API authentication	`gitee_com_linmes_authms_base_dto.SimpleResponse`
500	Internal server error	`gitee_com_linmes_authms_base_dto.SimpleResponse`

Referenced Schemas

dto.ValidDetailResponse

Field	Type	Required
`code`	`integer`	No
`data`	`dto.ValidResponse`	No
`message`	`string`	No
`timestamp`	`string`	No

dto.ValidResponse

Field	Type	Required	Example	Constraints	Description
`valid`	`boolean`	No	`True`

gitee_com_linmes_authms_base_dto.SimpleResponse

Field	Type	Required
`code`	`integer`	No
`message`	`string`	No
`timestamp`	`string`	No

Try this API in Scalar → Download OpenAPI spec (JSON) ↓

POST /internal/mfa/totp/validate