Your authenticator status
Whether this member has an authenticator, and how much rope is left. `enrolled` without `active` means a setup was started and never confirmed — the screen should offer to finish it rather than to start again, because starting again issues a new secret and invalidates the QR code already on screen. `recovery_codes_remaining` is here because running out and *then* losing the phone is the one state nobody can recover from unaided, and a member cannot be warned about a number they are never shown.
Whether this member has an authenticator, and how much rope is left.
enrolled without active means a setup was started and never
confirmed — the screen should offer to finish it rather than to start
again, because starting again issues a new secret and invalidates the QR
code already on screen.
recovery_codes_remaining is here because running out and then losing
the phone is the one state nobody can recover from unaided, and a member
cannot be warned about a number they are never shown.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Response Body
application/json
application/json
curl -X GET "https://example.com/api/b/v1/mfa"{ "enrolled": true, "active": true, "recovery_codes_remaining": 0}Sign out one device DELETE
End a single sign-in, leaving the others alone — IN-335. The case `revoke-all` cannot serve: a member who left a laptop somewhere wants that one cut off, not to be signed out of the machine they are asking from. Two things have to happen and only one of them is obvious. Deleting the session record takes it off this list; **it does not sign anybody out**, because nothing on the request path consults these records. What stops the device is `TokenService.revoke_session`, which denies the token's `sid` — and reaches the refresh token too, since it carries the same claim. Without that second step this endpoint would report success and leave the device working, which is the failure `revoke_all_user_sessions` was written to stop repeating. 404 for a session that is not this member's. The Redis key is `session:{user_id}:{session_id}`, so a caller can only ever name their own; the lookup is what turns someone else's id into "not found" rather than a silent no-op that looks like success.
Remove your authenticator DELETE
Turn the factor off, on proof. A code is required because a hijacked session that can silently remove the second factor has already removed it. A recovery code is accepted here too — someone whose phone is gone still needs a way out, and that is what recovery codes are for.