Skip to main content
PUT
Update Session
When an MFA challenge is needed, the partner responds to the initial POST /sessions request with one of the available MFA challenge responses. MX will collect the answers and provide them to the partner by making a PUT /sessions request. The partner can respond with a success response, another MFA challenge response, or an error response. If the answers provided were correct and the MFA has been satisfied, a success response containing the session key should be returned. If an additional MFA challenge is needed, another challenge can be returned. If the answers provided were incorrect, a 401 (Unauthorized) error should be returned. Partners may also choose to send another challenge; MX does not limit the number of challenges that partners can return. If you sent a list of MFA Options, the answer field will be assigned the option selected by the user. If a userkey is provided with the success response, it will be stored and used by MX as a credential for that user in future requests. This mechanism allows a partner to initially authenticate a user with a login, password, and MFA, then use the userkey in future sessions. If MX receives a 401 error on a request with a userkey, it will be assumed that the userkey has become invalid. MX will remove the userkey and retry the authentication with the login and password. This allows a partner to invalidate a userkey to force reauthenication if needed. Session Fields Challenge Fields