# already_enrolled

The user already has the second factor they are trying to enrol (409).

## Meaning

An MFA enrolment endpoint under `/v1/auth/mfa/` was called for an account that
already has an active second factor of that kind, for example a second TOTP
authenticator.

## Impact

Nothing changed; the existing factor keeps working. A user sees it after enrolling
twice in two tabs or by going back in the browser. It is harmless.

## Diagnosis

Look the request id up on the Troubleshooting page; the record carries cause
`already_enrolled`. The user's factors are listed by `GET /v1/auth/mfa` in their own
session.

## Mitigation

- As a user: use the factor you have, or remove it from your security settings and
  enrol again.
- As a client developer: read the factor status before offering enrolment.

## Escalation

Escalate when a user with no active factor gets it. Open an issue with the request id
and the server version. Never attach seeds or codes.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.