curl --request POST \
  --url https://{host}/v1/me/two-factor \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/vnd.api+json' \
  --data '
{
  "data": {
    "type": "two-factor",
    "attributes": {
      "secret": "JBSWY3DPEHPK3PXP",
      "otp": "123456",
      "currentPassword": "the-one-they-typed"
    }
  }
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
  body: JSON.stringify({
    data: {
      type: 'two-factor',
      attributes: {
        secret: 'JBSWY3DPEHPK3PXP',
        otp: '123456',
        currentPassword: 'the-one-they-typed'
      }
    }
  })
};

fetch('https://{host}/v1/me/two-factor', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{host}/v1/me/two-factor",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'data' => [
        'type' => 'two-factor',
        'attributes' => [
                'secret' => 'JBSWY3DPEHPK3PXP',
                'otp' => '123456',
                'currentPassword' => 'the-one-they-typed'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/vnd.api+json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

import requests

url = "https://{host}/v1/me/two-factor"

payload = { "data": {
        "type": "two-factor",
        "attributes": {
            "secret": "JBSWY3DPEHPK3PXP",
            "otp": "123456",
            "currentPassword": "the-one-they-typed"
        }
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/vnd.api+json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "data": {
    "type": "two-factor",
    "attributes": {
      "enabled": true,
      "recoveryCode": "7QK2MP-XR4T9D-B8WLZC-N3VH6S"
    }
  }
}

{
  "errors": [
    {
      "status": "404",
      "code": "watch_reserved",
      "title": "Not Found",
      "detail": "<string>",
      "meta": {},
      "source": {
        "pointer": "/data/attributes/reference",
        "parameter": "<string>"
      }
    }
  ],
  "jsonapi": {
    "version": "1.0"
  }
}

{
  "errors": [
    {
      "status": "404",
      "code": "watch_reserved",
      "title": "Not Found",
      "detail": "<string>",
      "meta": {},
      "source": {
        "pointer": "/data/attributes/reference",
        "parameter": "<string>"
      }
    }
  ],
  "jsonapi": {
    "version": "1.0"
  }
}

{
  "errors": [
    {
      "status": "404",
      "code": "watch_reserved",
      "title": "Not Found",
      "detail": "<string>",
      "meta": {},
      "source": {
        "pointer": "/data/attributes/reference",
        "parameter": "<string>"
      }
    }
  ],
  "jsonapi": {
    "version": "1.0"
  }
}

{
  "errors": [
    {
      "status": "404",
      "code": "watch_reserved",
      "title": "Not Found",
      "detail": "<string>",
      "meta": {},
      "source": {
        "pointer": "/data/attributes/reference",
        "parameter": "<string>"
      }
    }
  ],
  "jsonapi": {
    "version": "1.0"
  }
}