Two-call flow with the same payload. Empty code validates the payload and issues an OTP challenge — response has data.type = "challenge" and carries expiration_at/resend_at/factor. Populated code re-validates, verifies the OTP, applies the toggle, and returns the persisted value — response has data.type = "user". Both flows return 201 (challenge) / 200 (apply); clients discriminate on data.type.