admin_second_factor_required
This code is raised on a non-customer surface (the /internal voice-runtime audience or telephony provider callbacks). It is excluded from the customer OpenAPI document and is registered here so an operator reading a log line has one place to look.
The staff session authenticated but has not proved a second factor (ADR-0024, amending ADR-0017 decision 6). Distinct from admin_step_up_required because the console's response differs: step-up re-authenticates and replays one request, whereas this one has to complete the sign-in factor before any console request will work, so a console that conflated them would replay a request that has not been admitted yet, forever. Cure: POST /admin/second-factor/challenges, then verify. Not an error condition - it is the second half of every staff sign-in.
Problem shape
Every non-2xx response is an RFC 9457 application/problem+json body. The type URI below is stable and machine-matchable, so branch on the final path segment (the code) and treat the status as redundant confirmation. See the error-handling guide.
{
"type": "https://docs.vocapable.com/errors/admin_second_factor_required",
"title": "…",
"status": 403,
"detail": "…",
"instance": "/v1/…"
}