GET	/api/mfa
POST	/api/mfa/totp/begin
POST	/api/mfa/totp/confirm
POST	/api/mfa/email/enable
PUT	/api/mfa/preferred
POST	/api/mfa/email/send-code
POST	/api/mfa/backup-codes/regenerate
POST	/api/mfa/disable
GET	/api/settings/mfa
PUT	/api/settings/mfa

Own MFA status

GET/api/mfa

Current user's MFA status + org policy.

Authentication: bearer token.
Permission: any signed-in user.

curl -X GET "https://shellius.example.com/api/mfa" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Begin TOTP enrolment

POST/api/mfa/totp/begin

Generate secret + QR.

Authentication: bearer token.
Permission: any signed-in user.

curl -X POST "https://shellius.example.com/api/mfa/totp/begin" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Confirm TOTP

POST/api/mfa/totp/confirm

Verify code, enable TOTP, return backup codes.

Authentication: bearer token.
Permission: any signed-in user.

Request body

Name	Type	Required	Notes
code	string	Yes

curl -X POST "https://shellius.example.com/api/mfa/totp/confirm" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "…"
  }'

200 OK

{ "success": true, "data": { … } }

Enable email OTP

POST/api/mfa/email/enable

Authentication: bearer token.
Permission: any signed-in user.

curl -X POST "https://shellius.example.com/api/mfa/email/enable" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Preferred

PUT/api/mfa/preferred

Authentication: bearer token.
Permission: any signed-in user.

Request body

Name	Type	Required	Notes
method	string	Yes	One of totp, email.

curl -X PUT "https://shellius.example.com/api/mfa/preferred" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "totp"
  }'

200 OK

{ "success": true, "data": { … } }

Send email OTP

POST/api/mfa/email/send-code

Self-service: email the current user a one-time code usable as { method: 'email', code } for /disable and /backup-codes/regenerate. Only when email MFA is enrolled; rate-limited (1 per 30s, 5 per 15 min per user — enforced in mfaService).

Authentication: bearer token.
Permission: any signed-in user.

curl -X POST "https://shellius.example.com/api/mfa/email/send-code" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Regenerate backup codes

POST/api/mfa/backup-codes/regenerate

Authentication: bearer token.
Permission: any signed-in user.

Request body

Name	Type	Required	Notes
method	string	Yes	One of totp, email.
code	string	Yes

curl -X POST "https://shellius.example.com/api/mfa/backup-codes/regenerate" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "totp",
    "code": "…"
  }'

200 OK

{ "success": true, "data": { … } }

Disable own MFA

POST/api/mfa/disable

Authentication: bearer token.
Permission: any signed-in user.

Request body

Name	Type	Required	Notes
method	string	No	One of totp, email, backup.
code	string	No
password	string	No

curl -X POST "https://shellius.example.com/api/mfa/disable" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "totp",
    "code": "…",
    "password": "…"
  }'

200 OK

{ "success": true, "data": { … } }

Read org MFA policy

GET/api/settings/mfa

Authentication: bearer token.
Permission: settings.mfa.

curl -X GET "https://shellius.example.com/api/settings/mfa" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Set org MFA policy

PUT/api/settings/mfa

Authentication: bearer token.
Permission: settings.mfa.

Request body

Name	Type	Required	Notes
enabled	boolean	Yes
enforced	boolean	No	Default false.
allowTotp	boolean	No	Default true.
allowEmailOtp	boolean	No	Default true.

curl -X PUT "https://shellius.example.com/api/settings/mfa" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": false
  }'

200 OK

{ "success": true, "data": { … } }