curl --request POST \
  --url https://api.example.com/v1/profile/security/2fa/enable \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "method": "app",
  "code": "<string>",
  "phone": "<string>"
}
'

{
  "backup_codes": [
    "12345678",
    "87654321"
  ],
  "recovery_key": "ABCD-EFGH-IJKL-MNOP"
}