List the own second factors

The own access's second factors, recovery codes left, PUK - with a session only.

RReadIdempotentbeta

POST

/v1/access/tfa/liston https://api.manitu.de

Try it

Not offered over MCP - only to programs over REST.

Authentication

One of X-API-Key, Authorization: Bearer … - never more than one in a request. More

Request body JSON; unknown fields are refused

No fields - send {} or no body.

Response in `data`; the rest of the body as on every call

tfa_listarray of objectrequired

tfa_list[].tfa_idintegerrequired

tfa_list[].typestringrequired

oath-totp: a code from an authenticator app; fido-u2f: a security key.

One of oath-totp fido-u2f

tfa_list[].statusstringrequired

inactive: kept, but not asked for at sign-in.

One of active inactive

tfa_list[].descriptionstring | nullrequired

What the customer wrote about it (his description), null if nothing - not its name or user name.

tfa_list[].is_defaultbooleanrequired

The one the sign-in asks for first.

tfa_list[].created_atstring | nullrequired

Format date-time

recovery_code_countintegerrequired

Recovery codes not used yet.

puk_existsbooleanrequired

Whether the main access has a PUK (sent by letter); false for a sub access.

Statuses

200Success.400The request does not match the declared input schema.401No credential was presented, or it was not recognised.403The credential is not permitted to use this operation.500The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.503The channel this operation forwards through is unavailable.

POST/v1/access/tfa/list

Request

curl -X POST 'https://api.manitu.de/v1/access/tfa/list' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{}'

const response = await fetch('https://api.manitu.de/v1/access/tfa/list', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
});
const answer = await response.json();

<?php

$curl = curl_init('https://api.manitu.de/v1/access/tfa/list');

curl_setopt_array($curl, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => [
        'X-API-Key: ' . getenv('API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => '{}',
    CURLOPT_RETURNTRANSFER => true,
]);

$answer = json_decode(curl_exec($curl), true);

import os

import requests

response = requests.request(
    "POST",
    "https://api.manitu.de/v1/access/tfa/list",
    headers={"X-API-Key": os.environ["API_KEY"]},
    json={},
)
answer = response.json()

Response 200

{
  "status": {
    "type": "success",
    "code": 200
  },
  "meta": {},
  "data": {
    "tfa_list": [
      {
        "tfa_id": 12345,
        "type": "oath-totp",
        "status": "active",
        "description": "Example",
        "is_default": true,
        "created_at": "2026-10-23T12:00:00+02:00"
      }
    ],
    "recovery_code_count": 1,
    "puk_exists": true
  }
}

List the own second factors

Authentication

Request body JSON; unknown fields are refused

Response in data; the rest of the body as on every call

Statuses

Response in `data`; the rest of the body as on every call