Read the caller's 2FA enrollment status

GET

/account/security/2fa

• Local development behind nginx (port 8088 by default)

Returns whether the caller has enrolled, whether the enrollment is confirmed, when it was last used, and how many unused recovery codes remain. Used by the /account/ security page to render the “enroll” vs “manage” branch.

Authorizations

• cookieAuth
• bearerAuth

Responses

200

Caller’s TOTP status.

Caller-facing 2FA enrollment status.

object

enrolled

required

True when any user_totp row exists for the caller.

boolean

confirmed

required

True when the enrollment is past the confirm step. Only confirmed enrollments gate the login flow.

boolean

enrolled_at

string format: date-time

nullable

confirmed_at

string format: date-time

nullable

last_used_at

string format: date-time

nullable

recovery_codes_remaining

required

Number of unused single-use backup codes. Drops as the user redeems them; regenerate via the dedicated endpoint when low.

integer

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}