What it means
setup cannot replace an active factor.
How to handle it
Disable the active factor through the supported flow before starting a replacement setup.
Wire contract
| Code | mfa_already_enabled |
|---|---|
| Class | conflict |
| HTTP status | 409 |
| Meta keys | None |
| Raised | Yes |
The response uses the standard {"error": {…}} envelope. Branch on error.code, not the human-readable message. Preserve request_id when reporting a failure.