GET
/api/user/mfa/statusAuthenticatedGet my MFA status
Lists the caller's verified MFA factors (authenticator apps and passkeys) and how many recovery codes remain unused. Pending enrollments are not listed; use GET /api/user/mfa/status/{factor_type} for those. The payload is returned raw, without a success envelope.
operationId
get_api_user_mfa_statusMulti-factor authenticationAuthentication & permissionsAuthenticated
Any authenticated user
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Any authenticated user
Responses
application/json
MfaStatusAccount-wide MFA status: every verified factor plus the number of unused recovery codes.
enabled mirrors factors.length > 0.| Property | Type | Description |
|---|---|---|
| enabled* | boolean | |
| factors* | object[] | |
| factor_id* | string (uuid) | |
| factor_type* | "totp" | "webauthn" | |
| verified_at | integer | exclusiveMinimum: 0 |
| recovery_codes_remaining* | integer | minimum: 0 |
JSONExample
"enabled"true
"factors"
"factor_id""123e4567-e89b-12d3-a456-426614174000"
"factor_type""totp"
"verified_at"1
"recovery_codes_remaining"1
Example request
bashcurl
curl -X GET 'https://auth.schemavaults.com/api/user/mfa/status' \
-b 'refresh_token_<auth_server_app_id>=<value>'