Backup Codes Left
How many of your user's MFA backup codes are still unused. The codes themselves are never returned — they are shown once, by /mfa/enroll and /mfa/backup-codes/regenerate, and stored hashed. Each code works once; when you are running low, regenerate a fresh set of ten.
This read accepts any credential: an API key, a session JWT or an OAuth/MCP token. Regenerating the codes needs an interactive dashboard session.
Response (200 OK)
success boolean
true.remaining integer
Unused backup codes, from
0 to 10.Errors
Error bodies are {"success": false, "message": "…", "error": "…"} (error carries the same text as message).
400 Bad Request
MFA not enabled for this account — MFA is off, or enrolled but not yet activated.401 Unauthorized
Missing or invalid auth.
500 Internal Server Error
The MFA record could not be read.
Request
curl "https://api.ngris.com/v1/mfa/backup-codes" \
-H "X-API-KEY: <your_api_key>"
Response — 200 OK
{
"success": true,
"remaining": 7
}