> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Handling Multifactor Authentication

This guide explains how to handle multifactor authentication (MFA) when running an aggregation job.

<Info>
  **INFO**

  MFA is controlled by the institution's security settings, not by MX. MFA can be encountered at any step in the aggregation process.
</Info>

If you've been prompted for MFA, you've likely completed these steps:

1. Called an aggregation endpoint such as aggregation, IAV, account owner identification, or extend transaction history.
2. Checked the member's connection status: `GET /users/{user_guid}/members/{member_guid}/status`.

MFA is indicated when you see a `connection_status` of `CHALLENGED`. The response also returns a `challenges` array that includes the question(s) the end user must answer to proceed.

Make a note of both the `guid` in the `challenges` array and the `label` (for example: `What city were you born in?`).

Here is an example:

```json theme={null}
{
  "member": {
    "aggregated_at": "2020-09-21T19:48:57Z",
    "challenges": [
      {
        "field_name": null,
        "guid": "CRD-8f841084-66cb-4e3d-9253-96f97093100a",
        "label": "What city were you born in?",
        "type": 0
      }
    ],
    "connection_status": "CHALLENGED",
    "guid": "MBR-84ca0882-ad6c-4f10-817f-c8c0de7424fa",
    "is_authenticated": false,
    "is_being_aggregated": true,
    "successfully_aggregated_at": "2020-09-21T19:44:17Z"
  }
}
```

## Use the Resume Endpoint

The `PUT /users/{user_guid}/members/{member_guid}/resume` endpoint allows you to answer the challenges presented during MFA and continue the process. There are also other forms of MFA, such as choosing from multiple options (like choosing from a list of phone numbers to text a code to) or choosing the correct pre-determined photo. These are not covered in this guide, but they are possible scenarios with the MX API.

A relatively common scenario is requiring a one-time code texted to a phone number. In this case, use the resume endpoint twice: once to choose the phone number and again to provide the correct code. Also, use the connection status endpoint multiple times to get two different challenge GUIDs: one for the phone number and one for the code.

<Tip>
  **TIP**

  In this guide, we're using MX Bank test institution. To mimic a successful answer, use `correct` as the value.

  In an actual MFA situation, the end user will need to provide the correct answer to the question. If the security question is `What city were you born in?`, the answer may be `Chicago`, `Tallahassee`, etc.
</Tip>

In the body of the request, include the challenge `guid` provided in the previous response and the correct answer for the `label` field.

Notice that `connection_status` changed to `RESUMED` while `is_being_aggregated` remains `true`. The `is_authenticated` field is still `false`—meaning the MFA answer was accepted and the connection is proceeding, but the member's login credentials haven't been fully authenticated yet. Continue to poll the member's status to confirm there are no additional challenges or errors.

<CodeGroup>
  ```shell Request theme={null}
  curl -i -X PUT 'https://int-api.mx.com/users/USR-11141024-90b3-1bce-cac9-c06ced52ab4c/members/MBR-84ca0882-ad6c-4f10-817f-c8c0de7424fa/resume' \
  -u 'client_id:api_key' \
  -H 'Accept: application/vnd.mx.api.v1+json' \
  -H 'Content-Type: application/json' \
  -d '{
        "member": {
          "challenges": [
            {
              "guid": "CRD-8f841084-66cb-4e3d-9253-96f97093100a",
              "value": "correct"
            }
          ]
        }
      }'
  ```

  ```json Response theme={null}
  {
    "member": {
      "aggregated_at": "2020-09-21T19:48:57Z",
      "connection_status": "RESUMED",
      "guid": "MBR-84ca0882-ad6c-4f10-817f-c8c0de7424fa",
      "id": null,
      "institution_code": "mxbank",
      "is_being_aggregated": true,
      "metadata": null,
      "name": "MX Bank",
      "successfully_aggregated_at": "2020-09-21T19:44:17Z",
      "user_guid": "USR-11141024-90b3-1bce-cac9-c06ced52ab4c"
    }
  }
  ```
</CodeGroup>