opschain elevate
Included from Basic tier
opschain elevate [--totp-code <code> | --recovery-code <code>]
Elevates your session with a second factor
(AuthService.Elevate) — the step-up ceremony the floors demand before
protective writes (policy and owner writes, protective metadata,
legal hold, waiver grants). With neither code flag, the command prompts
for a TOTP code without echo. The elevation window is non-sliding; every
step-up refusal names this verb as the remedy.
Enrol a factor first if you have none:
opschain api v2 call AuthService/EnrolTOTPFactor -d '{"label":"cli"}',
then ActivateTOTPFactor with a code from the app.
Flags
| Flag | Meaning |
|---|---|
--totp-code <code> | A six-digit code from an active authenticator factor. |
--recovery-code <code> | An unspent one-time recovery code. |
Exit codes
| Code | Meaning |
|---|---|
| 0 | The session is elevated; the expiry is printed. |
| 1 | The proof did not verify, or the server refused the request. |
| 2 | Usage error — both code flags, or no server target. |
See also
opschain docs identity— authentication strength and the step-up floor.