As part of WE4.6.2, functionality is being added to allow users to enable multiple authentication factors, which includes WebAuthn and TOTP. When we log in through the API, and the user has multiple authenticators enabled, the login response will become slightly different, and will allow us to "select" the factor to be used. (Since we don't yet support WebAuthn, we will need to explicitly select TOTP.)
The logic for working with the new selection logic is laid out in this task.
(At the moment, there is some fallback compatibility logic that makes the API work as before with existing clients, but this will be removed once these tasks are complete and rolled out.)