Get MFA Status

Returns which second factors the account holds, which is preferred, and whether MFA is on at all.

This is the read a member makes about their own account — the self-service profile (GET /v1/users/{id}/profile) deliberately leaves MFA out and points here.

Read-only. The response carries Cache-Control: no-store: knowing which factors an account holds is exactly what an attacker wants before choosing an approach.

Failures:

• 404 — no such user.
• 503 IDE-0066 — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.

GET /v1/users/{id}/mfa

Get MFA Status

cURL

curl --request GET \
  --url https://identity.sandbox.lerian.net/v1/users/{id}/mfa \
  --header 'Authorization: Bearer <token>'

200

{
  "emailEnabled": false,
  "enabled": true,
  "methods": [
    "app",
    "email"
  ],
  "preferredType": "app",
  "totpEnabled": true
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Path Parameters

id · string · required

User ID.

Example:

"00000000-0000-0000-0000-000000000000"

Response

200

application/json

OK

emailEnabled · boolean

Example:

false

enabled · boolean

Example:

true

methods · string[]

Example:

["app", "email"]

preferredType · string

Example:

"app"

totpEnabled · boolean

Example:

true