curl --request POST \
--url https://api.qumo-deploy.com/v1/auth/totp/setup \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.qumo-deploy.com/v1/auth/totp/setup"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.qumo-deploy.com/v1/auth/totp/setup', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.qumo-deploy.com/v1/auth/totp/setup",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.qumo-deploy.com/v1/auth/totp/setup"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.qumo-deploy.com/v1/auth/totp/setup")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.qumo-deploy.com/v1/auth/totp/setup")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"secret": "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP",
"uri": "otpauth://totp/Qumo%20Deploy:[email protected]?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=Qumo%20Deploy",
"backup_codes": [
"7f3k9q2m",
"p4x8w1zt"
]
}{
"error": "organization_id is required"
}{
"error": "organization_id is required"
}{
"error": "organization_id is required"
}Start two-factor setup
Generates a new authenticator (TOTP) secret and one-time backup codes
for the signed-in user. Two-factor authentication is not active until
POST /v1/auth/totp/enable confirms a code. Calling it again replaces
an unconfirmed secret; once enabled it returns 409.
curl --request POST \
--url https://api.qumo-deploy.com/v1/auth/totp/setup \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.qumo-deploy.com/v1/auth/totp/setup"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.qumo-deploy.com/v1/auth/totp/setup', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.qumo-deploy.com/v1/auth/totp/setup",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.qumo-deploy.com/v1/auth/totp/setup"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.qumo-deploy.com/v1/auth/totp/setup")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.qumo-deploy.com/v1/auth/totp/setup")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"secret": "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP",
"uri": "otpauth://totp/Qumo%20Deploy:[email protected]?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=Qumo%20Deploy",
"backup_codes": [
"7f3k9q2m",
"p4x8w1zt"
]
}{
"error": "organization_id is required"
}{
"error": "organization_id is required"
}{
"error": "organization_id is required"
}Authorizations
The session token qumod login obtains through the device flow
(POST /v1/auth/device/token). It acts as the signed-in user, like a
console session, and needs no CSRF token.
Response
The provisional secret and backup codes. The backup codes are shown only here.
The shared secret (base32), for manual entry into an authenticator app.
"JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP"
An otpauth:// URI to render as a QR code.
"otpauth://totp/Qumo%20Deploy:[email protected]?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=Qumo%20Deploy"
One-time recovery codes. Shown only here.
["7f3k9q2m", "p4x8w1zt"]