Reports whether the caller's sign-in asks for a code.

GET

/api/v1/account/mfa

401 when nothing was signed in, 403 when a bearer token was used.

Authorization

session

cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

Whether two-step sign-in is on

application/json

Whether the account asks for a second step, as GET /account/mfa reports.

recovery_codes_left*integer

How many recovery codes are left unused.

Formatint64

Range0 <= value

totp_enabled*boolean

Whether signing in with the password asks for a code.

curl -X GET 'https://example.com/api/v1/account/mfa'

{  "recovery_codes_left": 0,  "totp_enabled": true}