---
title: "App-lock status for the current session"
method: GET
path: "/auth/app-lock"
tags: ["auth"]
---

# App-lock status for the current session

`GET /auth/app-lock`

## Response `200`

- AppLockStatusDto
  - `enabled` boolean, required — Whether a PIN is set for this user
  - `pinLength` object, nullable, required — Length of the stored PIN, or null when none is set
  - `locked` boolean, required — Whether this session is currently locked. Computed from the same expression the guard uses, so the two can never disagree about who is locked.
  - `resetPending` boolean, required — A reset was requested, by exhausting the attempts or by "Forgot PIN". A correct PIN still clears it while attempts remain — the client must not hide the PIN input on this flag alone, or a user whose reset was triggered by someone else can no longer use the PIN they know.
  - `attemptsRemaining` number, required — Attempts left before the lock is forced into a reset. Surfaced before the user burns one, so the count is visible rather than inferred.

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.dev/dre/apis/dre-api.md) · [All operations](https://skmtc.dev/dre/apis/dre-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dre/dre-api/revisions/5d14beb9482b/schema)