> ## Documentation Index
> Fetch the complete documentation index at: https://laas.mippo.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Confirm MFA for a pending transaction

> Submit the TOTP code from the end-user to clear the multi-factor authentication gate and continue a pending Pix to stablecoin transaction.

Used only when `authChallenge.type === 'MFA_TOTP'`. On success, returns the Pix QR payload to display to your user.

## Request

<ParamField header="X-Mippo-API-Key" type="string" required>
  Your LaaS API key.
</ParamField>

<ParamField path="id" type="string" required>
  Transaction ID from `POST /v1/laas/transactions/initiate`.
</ParamField>

<ParamField body="totpCode" type="string" required>
  6-digit TOTP code from the user's authenticator app.
</ParamField>

```json Request theme={null}
{
  "totpCode": "482910"
}
```

## Response

<ResponseField name="data.transactionId" type="string">
  Transaction ID.
</ResponseField>

<ResponseField name="data.status" type="string">
  `PENDING_PAYMENT` — Pix is ready, waiting for user to pay.
</ResponseField>

<ResponseField name="data.pixPayload" type="string">
  Pix Copia e Cola string. Encode as a QR code and display to the user.
</ResponseField>

<ResponseField name="data.pixExpiry" type="string">
  ISO 8601 timestamp when the Pix QR code expires (typically 15 minutes).
</ResponseField>

```json Response (200) theme={null}
{
  "success": true,
  "data": {
    "transactionId": "tx_1719000000_xyz",
    "status": "PENDING_PAYMENT",
    "pixPayload": "00020101021226890014br.gov.bcb.pix...",
    "pixExpiry": "2026-07-01T18:15:00.000Z"
  }
}
```

```json Response (422 — wrong code) theme={null}
{
  "success": false,
  "error": {
    "code": "MFA_INVALID_CODE",
    "message": "The TOTP code is invalid or has expired. Try again."
  }
}
```

<Warning>
  After 5 consecutive failed TOTP attempts, the transaction is locked and the user must start a new one. Mippo files an alert internally.
</Warning>