# List the own second factors

> The own access's second factors, recovery codes left, PUK - with a session only.

- Effect: Read - Changes nothing.
- Idempotent: yes
- Stability: beta
- REST: `POST https://api.manitu.de/v1/access/tfa/list`
- Page: /reference/access/tfa/list/

## REST

`POST https://api.manitu.de/v1/access/tfa/list`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

No fields - send {} or no body.

### Response

In `data`; the rest of the body as on every call.

- `tfa_list` (array of object, required)
  - `tfa_list[].tfa_id` (integer, required)
  - `tfa_list[].type` (string, required) - oath-totp: a code from an authenticator app; fido-u2f: a security key. (one of `"oath-totp"`, `"fido-u2f"`)
  - `tfa_list[].status` (string, required) - inactive: kept, but not asked for at sign-in. (one of `"active"`, `"inactive"`)
  - `tfa_list[].description` (string | null, required) - What the customer wrote about it (his description), null if nothing - not its name or user name.
  - `tfa_list[].is_default` (boolean, required) - The one the sign-in asks for first.
  - `tfa_list[].created_at` (string | null, required) - (format `date-time`)
- `recovery_code_count` (integer, required) - Recovery codes not used yet.
- `puk_exists` (boolean, required) - Whether the main access has a PUK (sent by letter); false for a sub access.

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/access/tfa/list' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

## Example result

```json
{
  "tfa_list": [
    {
      "tfa_id": 12345,
      "type": "oath-totp",
      "status": "active",
      "description": "Example",
      "is_default": true,
      "created_at": "2026-10-23T12:00:00+02:00"
    }
  ],
  "recovery_code_count": 1,
  "puk_exists": true
}
```