Re-prove a strong credential

POST
/v1/step-up

Confirms a sensitive action by password (and a code, if two-factor is on). A passkey instead re-asserts through /api/auth/passkey/verify-authentication. Either one starts a short grace window during which a gated action proceeds without being asked again.

Authorization

apiKey
headerAuthorizationBearer <token>

An API key from the Developers page. rhq_test_ keys reach the sandbox, rhq_live_ keys the live side.

Request Body

application/json
  1. body
password*string
Length1 <= length
code?string
Length1 <= length
backupCode?string
Length1 <= length

Response Body

Success

application/json
  1. response

Success

ok*true
Value intrue
expiresAt*string
curl -X POST "https://example.com/v1/step-up" \  -H "Content-Type: application/json" \  -d '{    "password": "string"  }'
{  "ok": true,  "expiresAt": "string"}