# Your Second Factor

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

Whether your account is asked a second factor at sign-in, and what it has enrolled.

## Overview

- `mode`: `off`, `log` (asked once enrolled) or `enforce` (required) — [Two-Factor Sign-In › Modes](https://docs.aureahub.com/docs/guide-two-factor.md). `required`: `true` in `enforce`.
- `enrolled`: an authenticator app is the account's factor; `methods` is then `["totp", "recovery_code"]`, else `[]`. `pending`: an enrolment waits for its first code. `recoveryCodesLeft`: the recovery codes not used yet.
- Any signed-in account; an End User's answers `mode` `off`.

## Endpoint

### `GET /v1/auth/mfa`

Authentication: bearer token required.

The caller's second factor.

**Responses**

`200` OK

```json
{
  "mode": "log",
  "required": false,
  "enrolled": true,
  "pending": false,
  "methods": ["totp", "recovery_code"],
  "recoveryCodesLeft": 9
}
```

**Example request**

```bash
curl https://api.aureahub.com/v1/auth/mfa \
  -H "Authorization: Bearer $ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#mfa-status