Authenticate the challenge ID (generated with /MFAChallenge.json) and token that was sent to your mobile device registered with BILL. In response, an mfaId value is generated and your API session is MFA trusted.
By default, MFA expires when the API session expires after 35 minutes of inactivity. If you set rememberMe as true in your /MFAAuthenticate.json request, the mfaId value is marked as trusted for 30 days. You can check the MFA status with /MFAStatus.json.
Authenticate the challenge ID and token with /MFAAuthenticate.json. At this point, the sessionId (from step one) is MFA trusted. Note that the mfaId token expires at end of the current session or when you sign out.
Maintaining MFA for 30 days
In step three of the MFA process, if you set rememberMe as true in your /MFAAuthenticate.json request, the mfaId value is marked as trusted for 30 days. For these 30 days, set deviceId and mfaId as additional fields when you sign in (/Login.json).
Click Try It! to start a request and see the response here!