GET
/api/user/mfa/status/{factor_type}AuthenticatedGet my status for one MFA factor type
Reports whether the caller has a verified factor of the given type (enabled) or an enrollment in progress (pending); the two are mutually exclusive. Unlike GET /api/user/mfa/status this includes unconfirmed enrollments, so the settings UI can resume a pending setup. The payload is returned raw, without a success envelope.
operationId
get_api_user_mfa_status_factor_typeMulti-factor authenticationAuthentication & permissionsAuthenticated
Any authenticated user
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Any authenticated user
Path parameters
| Name | Type | Description |
|---|---|---|
| factor_type* | "totp" | "webauthn" | The factor type to report on |
Responses
application/json
MfaFactorStatusStatus of one factor type.
enabled means a verified factor of that type exists; pending means an enrollment was started but not confirmed yet. factor_id / factor_type are present whenever a factor row exists, verified_at (Unix epoch milliseconds) only when enabled.| Property | Type | Description |
|---|---|---|
| enabled* | boolean | |
| pending* | boolean | |
| factor_id | string (uuid) | |
| factor_type | "totp" | "webauthn" | |
| verified_at | integer | exclusiveMinimum: 0 |
JSONExample
"enabled"true
"pending"true
"factor_id""123e4567-e89b-12d3-a456-426614174000"
"factor_type""totp"
"verified_at"1
Example request
bashcurl
curl -X GET 'https://auth.schemavaults.com/api/user/mfa/status/<factor_type>' \
-b 'refresh_token_<auth_server_app_id>=<value>'