# Verify patient MFA code

Canonical page: https://docs.ovok.com/api/tenant-authentication/verify-patient-mfa-code

`POST /auth/tenant/Patient/login/mfa`

Verifies the TOTP code of a patient who has MFA enrolled, after `login/start` answered `nextStep: "mfa"`. Returns the session code for `login/token`.

**Auth:** none. The `loginId` from `login/start` identifies the login.

## Behaviour

- `mfaToken` must equal the current TOTP code generated from the user's MFA secret.
- On success the login is marked MFA-verified and the response is `{ "nextStep": "token", "sessionCode": ... }`. Pass `sessionCode` to `POST /auth/tenant/Patient/login/token`.
- Error responses are delayed to take at least one second.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/auth/tenant/Patient/login/mfa' \
  -H 'Content-Type: application/json' \
  -d '{
    "loginId": "c3499c27-2973-0a7f-807e-fb8676a92dcb",
    "mfaToken": "123456"
  }'
```