auth
App-lock status for the current session
get/auth/app-lock
Response
enabledboolean required
Whether a PIN is set for this user
pinLengthobject nullable required
Length of the stored PIN, or null when none is set
lockedboolean required
Whether this session is currently locked. Computed from the same expression the guard uses, so the two can never disagree about who is locked.
resetPendingboolean required
A reset was requested, by exhausting the attempts or by "Forgot PIN". A correct PIN still clears it while attempts remain — the client must not hide the PIN input on this flag alone, or a user whose reset was triggered by someone else can no longer use the PIN they know.
attemptsRemainingnumber required
Attempts left before the lock is forced into a reset. Surfaced before the user burns one, so the count is visible rather than inferred.