Security and sign-in
Confirm two-factor during sign-in
POST
/api/auth/mfa/enrol/confirm#Authentication
Public
No credential. Public routes are rate limited per address.
Carries the short-lived MFA ticket that POST /api/auth/login returned, not a session.