---
title: "Initialize the MFA. For internal use."
slug: "initialize-the-mfa-for-internal-use-1"
updated: 2026-03-02T22:30:52Z
published: 2026-03-02T22:35:48Z
canonical: "support.appgate.com/initialize-the-mfa-for-internal-use-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Initialize the MFA. For internal use.

Post/authentication/otp/initialize

This API starts the Multi-Factor Authentication process. It requires the partial AuthToken from Authentication call. The Controller will initiate the flow and return details required to continue MFA.

SecurityHTTPType bearer

Body parameters

Optional MFA initialization details.

<select class='api-response-data' aria-label='Media type'><option value='d1d41ae5-706d-47f3-9c4d-a0149e5f57d2'>application/json</option>
</select>object  userPasswordstring    

Some MFA configurations require user password in order to authenticate the user along with the multi-factor. Otherwise not required.

ExampletSW3!QBv(rj{UuLY

Responses200

MFA initialization response.

<select class='api-response-data' aria-label='Media type'><option value='1a68e4fe-c0da-4da6-a539-58ec58de2b20'>application/json</option>
</select>object  typestring    

The type of the Multi-Factor Authentication.

- 'AlreadySeeded': The MFA provider is the built-in Time-based OTP provider and the user has already
a seed in the system. OTP is required on the next step.
- 'Secret': The MFA provider is the built-in Time-based OTP provider and this is the first time the
user is doing an MFA. It includes details about the seed. OTP is required on the next step.
- 'Challenge': The MFA provider is a RADIUS provider. It might include a challenge that needs to be
sent back. OTP is required on the next step.
- 'Push': The MFA provider is a RADIUS provider but the authentication is done externally, such as a
mobile app that prompts. Send a dummy OTP right away to trigger the external authentication.

Valid values[
  "AlreadySeeded",
  "Secret",
  "Challenge",
  "Push"
]
secretstring    

The seed for the built-in Time-based OTP provider. Used when configuring TOTP apps manually. Only available in Secret type.

Example6XOEKS6WZASFPA5A
otpAuthUrlstring    

A URL for triggering TOTP apps directly and configuring an entry automatically. Only available in Secret type.

Exampleotpauth://totp/admin@local@appgate.company.com?secret=6XOEKS6WZASFPA5A&issuer=Appgate%20SDP
barcodestring  (byte)    

The barcode image in jpg format. Base64 encoded. Only available in Secret type.

responseMessagestring    

A message from the RADIUS MFA provider. Only available in Challenge type.

ExamplePlease enter enter 1234 to your token.
statestring  (byte)    

State send by the RADIUS MFA provider as challenge. It needs to be sent back during MFA authentication. Only available in Challenge type.

timeoutnumber    

How long the Controller wait for RADIUS response. Especially useful for external authentication mechanism. Clients waiting shorter than this timeout will fail with a wrong error. Only available in Challenge and Push type.

Example10.0
sendPasswordboolean    

Whether the RADIUS MFA provider expecting the user password for authentication. If true, the user password needs to be sent as otp instead of a dummy value. Only available in Push type.

400

JSON error. Check the JSON format.

<select class='api-response-data' aria-label='Media type'><option value='ba8e1185-276c-4c5e-bff3-ef363878ad2f'>application/json</option>
</select>object  

Generic HTTP error.

idstring    

Machine readable error code.

messagestring    

Human readable error details.

401

Token error. Login again.

<select class='api-response-data' aria-label='Media type'><option value='b3a00da2-0c8e-46d2-93be-fd0cabf1037a'>application/json</option>
</select>object  

Generic HTTP error.

idstring    

Machine readable error code.

messagestring    

Human readable error details.

406

Invalid 'Accept' header.

<select class='api-response-data' aria-label='Media type'><option value='6ad02fe9-15a8-44f3-ac00-a11bd9980d1e'>application/json</option>
</select>object  

Generic HTTP error.

idstring    

Machine readable error code.

messagestring    

Human readable error details.

422

Request validation error. Check "errors" array for details.

<select class='api-response-data' aria-label='Media type'><option value='281749ed-78ae-469a-b301-6ac1266fc825'>application/json</option>
</select>Expand Allobject  

Http 422 error for object validation.

idstring    

Machine readable error code.

messagestring    

Human readable error details.

errors Array of object   

List of fields with validation errors.

object  fieldstring    

Name of the field that failed validation.

Examplename
messagestring    

Failure reason.

Examplemay not be null

500

Unexpected server side error.

<select class='api-response-data' aria-label='Media type'><option value='04732400-0729-42bf-9772-fadf3f65f54c'>application/json</option>
</select>object  

Generic HTTP error.

idstring    

Machine readable error code.

messagestring    

Human readable error details.