username+password in the body (no Bearer required); server re-verifies the passcode before writing.curl --location --request POST 'https://awqacore01.crexendocloud.com/ns-api/v2/oauth/mfaEnroll' \
--header 'Content-Type: application/json' \
--data-raw '{
"ns_id": "1060@totpOnly",
"ns_id_type": "subscriber",
"mfa_key": "VJTV4FEP65E7PDSS",
"mfa_vendor": "google",
"mfa_type": "authenticator",
"mfa_passcode": "847291",
"username": "1060@totpOnly",
"password": "<portal password>"
}'{"code":404,"message":"Missing action [OA049]"}