Retrieve an identity MFA method

Fetch a single multi-factor authentication method belonging to the authenticated identity by its unique identifier. Use this to check the current status of an MFA method (for example, whether it is pending, active, inactive, or pending-deactivation) before deciding whether to prompt the user to complete setup, re-verify, or remove it. The identity_id used to scope the lookup is always taken from the bearer token, so the method must belong to the authenticated identity — methods belonging to other identities are never returned, and a mismatch is indistinguishable from a non-existent record (both return 404). Sensitive fields such as the encrypted TOTP secret, the secure-pin hash, and backup code/answer hashes are never included in the response; for secure-pin methods only the security question codes (not the answers) are exposed, a has_backup_codes flag replaces the raw backup codes, and for passkey methods only non-secret device metadata (device_id, device_name, device_type) is exposed — the WebAuthn credential id, public key, signature counter, and pending registration challenge are never returned.

{ "message": "Identity MFA retrieved successfully", "status": "success", "data": { "id": "01HXYZ1234567890ABCDEFGHIJ", "identity_id": "01HABC9876543210ZYXWVUTSRQ", "type": "authenticator", "status": "active", "contexts": [ "login" ], "system_meta": { "email": null, "mobile": null, "security_questions": null, "has_backup_codes": true, "passkey": null }, "created": 1722869520000, "updated": 1722869520000 } }

Retrieve an identity MFA method

Request

Responses