Get MFA enrollment summary for an identity
/portal/v1/accounts/{accountSlug}/identities/{id}/mfaAuthentication
- Bearer Token
AuthorizationJWT access token
Path Parameters
| Name | Required | Type | Description |
|---|---|---|---|
id | string |
Code samples
curl -X GET "https://api.canopy.dev/portal/v1/accounts/{accountSlug}/identities/value/mfa" \
-H "Authorization: Bearer $CANOPY_TOKEN"const response = await fetch("https://api.canopy.dev/portal/v1/accounts/{accountSlug}/identities/value/mfa", {
method: "GET",
headers: {
"Authorization": "Bearer $CANOPY_TOKEN"
},
});
const data = await response.json();import requests
response = requests.get(
"https://api.canopy.dev/portal/v1/accounts/{accountSlug}/identities/value/mfa",
headers={
"Authorization": "Bearer $CANOPY_TOKEN"
},
)
data = response.json()package main
import (
"net/http"
)
func main() {
req, _ := http.NewRequest("GET", "https://api.canopy.dev/portal/v1/accounts/{accountSlug}/identities/value/mfa", nil)
req.Header.Set("Authorization", "Bearer $CANOPY_TOKEN")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
}Responses
200 Returns the identity's enrolled factors (TOTP and WebAuthn rows with redacted secrets), the current recovery-code generation count + remaining count, and the most-recent admin-reset timestamp.
{
"factors": [
{
"id": "00000000-0000-0000-0000-000000000000",
"type": "totp",
"label": "iPhone 15",
"enrolled_at": "2026-04-20T12:00:00.000Z",
"last_used_at": "2026-04-20T12:00:00.000Z"
}
],
"recovery_codes_generation": 0,
"recovery_codes_remaining": 0,
"mfa_admin_reset_at": "2026-04-20T12:00:00.000Z"
}application/json
factors *MfaFactorResponseDto[]recovery_codes_generation *numberGeneration number of the active recovery-code batch. 0 means no batch has ever been issued; 1+ tracks regenerations.
recovery_codes_remaining *numberUnredeemed code count in the current generation.
mfa_admin_reset_atstring (date-time)Timestamp of the most recent admin force-reset. `null` if MFA has never been reset for this identity.
401 Invalid or expired token
403 This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)
404 Identity not found