1. Docs
  2. API Reference
  3. List the caller's enrolled second factors

List the caller's enrolled second factors

GET/v1/auth/mfa/factors

Lists the authenticated administrator's own second factors (UserJwtGuard): id, type (totp or webauthn), label, when it was enrolled and when it last answered a challenge or a step-up. Passkeys report the relying party they are bound to, always Canopy's.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Responses

application/json

  • itemsMfaFactorResponseDto[]*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Returned object

MfaFactorResponseDtoView all properties on this resource
Request
curl -X GET "https://auth.canopy-io.com/v1/auth/mfa/factors" \
  -H "Authorization: Bearer $CANOPY_TOKEN"
Response
{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "type": "totp",
      "label": "iPhone 15",
      "enrolled_at": "2026-04-20T12:00:00.000Z",
      "last_used_at": "2026-04-20T12:00:00.000Z",
      "webauthn_rp_id": "acme.com"
    }
  ]
}
 Related endpoints
POSTBegin authenticator app enrollment
POSTComplete authenticator app enrollment
POSTBegin passkey enrollment
POSTComplete passkey enrollment
POSTProve a fresh second factor before a sensitive change
POSTBegin a passkey step-up
POSTComplete a passkey step-up
DELETERemove one of the caller's second factors
GETHow many recovery codes the caller has left
POSTRegenerate the caller's recovery codes
GETList the caller's remembered devices
DELETEForget every remembered device
DELETEForget one remembered device
 Was this page helpful?

Tell us how we can improve this guide.

Canopy