:::endpoint POST /v1/me/two-factor/confirm

The second half. When the code is right the account has two-factor from now
on, and the answer carries the recovery codes. Show them; they can be read
again with [the recovery codes](/docs/api/apps/recovery-codes), but most people
keep them when they are first put in front of them.

## Request

```bash
curl -X POST https://api.proppertrading.com/v1/me/two-factor/confirm \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 8e0a2c4d-6f8b-4d1e-a3c5-7e9b1d3f5a7c" \
  -d '{"code": "492817"}'
```

## Response

```json
{
    "data": {
        "object": "recovery_codes",
        "codes": [
            "Jy9hX6BD6l-lYhIP6Ntnz",
            "8LXgjpnR6t-prfYWRTUew",
            "RoG7CwJrOh-87xXtpj7J4",
            "JzhugBEBDE-u01QrIF8i0",
            "LYVFPDTuO9-FKLEPPim4M",
            "2EaKE8LlYB-ulwtc6u5gU",
            "EwVkoPyHrP-TEqmVABcQp",
            "9c0OGu65f3-sLKc579im1"
        ]
    },
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}
```

## Errors

| Status | Code                         | Meaning                                                  |
| ------ | ---------------------------- | -------------------------------------------------------- |
| 400    | `invalid_two_factor_code`    | Wrong code. Try the next one; the secret stays            |
| 400    | `two_factor_not_started`     | No secret to confirm. [Ask for one](/docs/api/apps/two-factor-enable) first |
| 400    | `two_factor_already_enabled` | The account already has an authenticator                 |
| 403    | `insufficient_scope`         | This device does not hold `me:write`                     |
| 429    | `rate_limit_exceeded`        | Shares the limit of the two-factor step of signing in    |

A wrong code here is a 400, not the 401 the sign-in step answers: the token is
fine, and a client that signs out on any 401 would be right to.