Says whether two-factor authentication is on for your account.
HTTP
GET /account/mfaAccess: Session token only. API keys get 403 with insufficient_scope.
Response 200 #
JSON
{ "enabled": true, "enabledAt": "2026-10-17T09:30:00+00:00", "recoveryCodesLeft": 9 }Response fields #
| Field | Type | Description |
|---|---|---|
enabled | boolean | Whether signing in asks for a code. |
enabledAt | string or null | When it was turned on. |
recoveryCodesLeft | integer | How many recovery codes can still be used. |
Errors #
| Status | error | When |
|---|---|---|
| 401 | unauthenticated | The token is missing or not valid. |
| 429 | rate_limited | Too many requests, see Rate limiting. |
See Errors for the error format.