Step-up Request

Create a five-minute remote_action challenge bound to the authenticated user token sid and explicit tenant/project. Choose context_id or tenant_id with optional project_id exclusively. The caller service account and request_ref identify the original request; retries return its challenge, changed parameters are rejected. The BES page accepts a live SSO of the same person, including another device, and shows a return-to-product message without redirecting. Missing required_assurance uses current tenant MFA policy; an explicit value cannot weaken that policy. No login or token is created. When the level needed asks for a second factor and the person has no active one, no challenge is created and MFA_ENROLLMENT_REQUIRED is returned; the person must set up a factor first.

POST /api/sessions/step-up