POST /api/admin/auth/step-up

Developing

POST

/api/admin/auth/step-up

POST /api/admin/auth/step-up {password, code}: re-proves both factors; dangerous actions then work for 10 minutes.

Staff cookie session; any admitted staff member. Write requests need same-origin JSON and X-Admin-CSRF from this session.

Source snapshot: admin/src/app/api/admin/auth/step-up/route.ts. This reference describes the current working tree, not proof of deployment. The response service types and validators remain authoritative.

Request

Authorization

API Key

Add parameter in cookie

__Host-hwa_session

Example:

__Host-hwa_session: ********************

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

POST /api/admin/auth/step-up {password, code}: re-proves both factors; dangerous actions then work for 10 minutes.

Bodyapplication/json

🟠400

🟠401

🟠403

🟠429

⚪default

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/admin/auth/step-up' \
--header 'X-Admin-CSRF;' \
--header 'Content-Type: application/json' \
--data '{
    "password": "string",
    "code": "string"
}'

Response Example

200 - Example 1

{}

Modified at 2026-10-26 13:41:16

POST /api/admin/auth/sign-out

README — DELETE /api/admin/hooks/{id}