Get user's MFA verifications

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL

https://openapi.logto.io/mcp

Standard setup for AI tools providing an mcp.json file

mcp.json 
{
  "Logto API references MCP server": {
    "url": "https://openapi.logto.io/mcp"
  }
}
Close
GET /api/users/{userId}/mfa-verifications
O auth2

Get a user's existing MFA verifications for a given user ID.

Path parameters

  • userId string Required

    The unique identifier of the user.

Responses

  • 200 application/json

    An array of MFA verifications for the user.

    Hide response attributes Show response attributes object
    • id string Required
    • createdAt string Required
    • lastUsedAt string
    • type string Required

      Values are Totp, WebAuthn, BackupCode, EmailVerificationCode, or PhoneVerificationCode.

    • agent string
    • name string
    • remainCodes number
    • rpId string

      The relying party ID the WebAuthn credential was registered for. Only present for WebAuthn verifications. Absent for credentials registered before it was recorded and not used to sign in since; such a credential is bound to the domain that served the sign-in page at registration, which may not be the current custom domain.

    • credentialId string

      The base64url-encoded WebAuthn credential ID. Only present for WebAuthn verifications. The credential's userHandle is the UTF-8 bytes of the path userId.

    • publicKey string

      The base64url-encoded COSE public key of the WebAuthn credential. Only present for WebAuthn verifications.

    • transports array[string]

      The transports the authenticator reported at registration. Only present for WebAuthn verifications.

      Values are usb, nfc, ble, internal, cable, hybrid, or smart-card.

    • counter number

      The last WebAuthn signature counter (signCount) seen for the credential. Only present for WebAuthn verifications.
  • 400

    Bad Request

  • 401

    Unauthorized

  • 403

    Forbidden

  • 404

    Not Found

GET /api/users/{userId}/mfa-verifications 
curl \
 --request GET 'https://[tenant_id].logto.app/api/users/{userId}/mfa-verifications' \
 --header "Authorization: Bearer $ACCESS_TOKEN"
Response examples (200) 
[
  {
    "id": "string",
    "createdAt": "string",
    "lastUsedAt": "string",
    "type": "Totp",
    "agent": "string",
    "name": "string",
    "remainCodes": 42.0,
    "rpId": "string",
    "credentialId": "string",
    "publicKey": "string",
    "transports": [
      "usb"
    ],
    "counter": 42.0
  }
]