Skip to content
Kindgi

A person's second factor

View as Markdown
GET
/v1/identity/users/{userId}/second-factor
curl --request GET \
  --url https://example.com/v1/identity/users/example/second-factor \
  --header 'Authorization: Bearer <token>'

Whether they have a second factor set up, since when, how many recovery codes are left, and whether it can still be used. Never a key or a code. Tenant admins only. Mounted when the deployment keeps second factors (from 0.1.9).

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
userId
required
string
>= 1 characters

Responses

Section titled “Responses”

200

Section titled “200”

Their second factor.

Media typeapplication/json

A person’s second factor, and whether their workspace requires one. With setUp, since, recoveryCodesLeft and usable are given; without it, started. Never a key or a code.

object
setUp
required
boolean
started

A key was given to set one up, and isn’t confirmed yet.

boolean
since
string format: date-time
recoveryCodesLeft
integer
usable

false: its key can’t be opened any more (the sign-in secret changed past it). A recovery code still works, as does setting it up again, or an admin removing it.

boolean
required
required

The workspace requires a second factor at sign-in.

boolean
Examplegenerated
{
  "setUp": true,
  "started": true,
  "since": "2026-04-15T12:00:00Z",
  "recoveryCodesLeft": 1,
  "usable": true,
  "required": true
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

403

Section titled “403”

Not a tenant admin.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

404

Section titled “404”

No user with that id under this tenant (identity-user-not-found).

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also