---
title: "Read your two-step verification status"
method: GET
path: "/v1/account/security"
tags: ["Account security"]
---

# Read your two-step verification status

`GET /v1/account/security`

## Request

- Base URL: `https://api.banksync.io`
- URL: `https://api.banksync.io/v1/account/security`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Whether two-step verification is on for the BankSync login this credential acts for, whether a recovery key was saved or used, and when BankSync last verified it. Always your own account; never another member’s.

## Response `200`

Your two-step status

- object
  - `success` true, required
  - `data` object, required
    - `twoFactor` object, required
      - `enabled` boolean, required: Two-step verification is on for this BankSync login.
      - `enrolledAt` string, date-time, nullable, required: When the current authenticator was added.
    - `recoveryKey` object, required
      - `saved` boolean, required: The person confirmed saving a recovery key for this authenticator.
      - `savedAt` string, date-time, nullable, required
      - `usedAt` string, date-time, nullable, required: The latest sign-in with this authenticator's recovery key.
    - `needsReplacement` boolean, required: The recovery key was used since the authenticator was added; replacing it retires the key.
    - `verifiedAt` string, date-time, nullable, required: When BankSync last verified the authenticator.

## Other responses

- `400`: Invalid input
- `401`: Unauthorized
- `403`: Forbidden — a missing `account:read` scope, or an installed app
- `503`: The security record could not be read right now; retry

---

[API](https://skmtc.dev/banksync/apis/banksync-api.md) · [All operations](https://skmtc.dev/banksync/apis/banksync-api/llms.txt) · [OpenAPI document](https://skmtc.dev/banksync/apis/banksync-api/revisions/94465f5ee922?raw)