Skip to main content

Step-Up

POST 
/api/auth/step-up

Requests step-up authentification. This re-authentication is required by critical endpoints.

2FA:

If the user enabled 2FA, the step-up will not be granted immediately. Instead, a TwoFactorAuthenticationToken is set as HTTP-only cookie and returned in the response body if header authentication is enabled.

You can complete the step-up through the endpoint POST /api/auth/2fa/step-up.

Request Body:

When requesting a step-up for a GUEST there is no way to authenticate the user. Therefore, no request body is required in this case.

If you request a step-up for a regular USER, it will result in a 400 - BAD REQUEST.

Locale​

A locale can be specified for this request. This will be used for the email 2FA code if this method is enabled for the user. You can learn more about 2FA through email here.

If no locale is specified, the applications default locale will be used. You can learn more about configuring the default locale here.

Tokens​

  • Requires a valid AccessToken.
  • If 2FA is disabled and the request is successful, StepUpToken will automatically be set as HTTP-only cookie. If header authentication is enabled, the StepUpToken will be returned in the response body and can be used to authorized critical requests.

Request​

Responses​

Authentication successful.