MFA Status

GET /v1/mfa/status

Whether two-factor authentication (TOTP) is on for your user. MFA is a property of the user, not of an account: it protects your interactive sign-in (/auth/login followed by /auth/mfa) in every account you belong to. API keys authenticate on their own and are never asked for a code.

The lifecycle is enroll (get a secret and backup codes) → activate (prove the authenticator works; MFA is on from here) → disable. An enrollment that was started but not yet activated, or MFA that was disabled, reads enabled: false with its timestamps present.

This read accepts any credential: an API key, a session JWT or an OAuth/MCP token. Enrolling, activating, checking a code (/mfa/verify), disabling and regenerating backup codes need an interactive dashboard session (a session JWT) and refuse API keys and OAuth/MCP tokens with 403.

Response (200 OK)

success boolean
Always true on a 200.
mfa.enabled boolean
true once an enrollment has been activated and until MFA is disabled.
mfa.created_at datetime
When the current enrollment was started (a new enrollment replaces an earlier one). Omitted when you have never enrolled.
mfa.updated_at datetime
Last change to the MFA record — for example activation, disabling, a code being used or the backup codes being replaced. Omitted when you have never enrolled.
mfa.last_used datetime | null
When an authenticator code was last accepted at sign-in or by /mfa/verify, or a backup code was last used; null if never. Omitted when you have never enrolled.

Errors

401 Unauthorized
Missing or invalid auth.
500 Internal Server Error
Failed to retrieve MFA status (plain-text body).
Request
curl "https://api.ngris.com/v1/mfa/status" \ -H "X-API-KEY: <your_api_key>"
Response — 200 OK (MFA on)
{ "success": true, "mfa": { "enabled": true, "created_at": "2026-10-02T08:41:17Z", "updated_at": "2026-10-19T16:03:44Z", "last_used": "2026-10-19T16:03:44Z" } }
Response — 200 OK (never enrolled)
{ "success": true, "mfa": { "enabled": false } }
On this page
MFA Status
Homepage Docs Dashboard Docs API Docs nvelox Dashboard