---
title: "Returns the current status of MFA enrollment"
method: GET
path: "/current-identity/mfa"
tags: ["Current Identity", "MFA"]
---

# Returns the current status of MFA enrollment

`GET /current-identity/mfa`

## Request

- Base URL: `https://demo.ziti.dev/edge/client/v1`
- URL: `https://demo.ziti.dev/edge/client/v1/current-identity/mfa`
- Auth: one of:
  - API key in header `zt-session`
  - OAuth 2
    - Authorization code: `/oidc/authorize`
    - Token URL: `/oidc/token` scopes: `openid`
- TypeScript: <https://skmtc.dev/openziti/apis/ziti-edge-client/docs/current-identity/mfa/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns details about the current MFA enrollment. If enrollment has not been completed it will return the current MFA configuration details necessary to complete a `POST /current-identity/mfa/verify`.

## Response `200`

The details of an MFA enrollment

- DetailMfaEnvelope
  - `data` DetailMfa, required: Fields shared by all Edge API entities
    - `_links` object, required: A map of named links
    - `createdAt` string, date-time, required
    - `id` string, required
    - `tags` Tags
    - `updatedAt` string, date-time, required
    - `isVerified` boolean, required
    - `provisioningUrl` string: Not provided if MFA verification has been completed
    - `recoveryCodes` string[]: Not provided if MFA verification has been completed
  - `meta` Meta, required
    - `apiEnrollmentVersion` string
    - `apiVersion` string
    - `filterableFields` string[]
    - `pagination` Pagination
      - `limit` number, required
      - `offset` number, required
      - `totalCount` number, required

## Other responses

- `401`: The supplied session does not have the correct access rights to request this resource
- `404`: The requested resource does not exist

## Changes

- **2026-10-14** `f7b51eaafbbb`: 1 breaking
  - the response property `data/allOf[#/components/schemas/baseEntity]/tags` became nullable for the status `200`
- **2024-05-29** `cce2800c1357`: 3 warning
  - the optional response header `WWW-Authenticate` removed for the status `200`
  - the optional response header `WWW-Authenticate` removed for the status `401`
  - the optional response header `WWW-Authenticate` removed for the status `404`

[Operation history](https://skmtc.dev/openziti/apis/ziti-edge-client/changes/current-identity/mfa/get.md)

---

[API](https://skmtc.dev/openziti/apis/ziti-edge-client.md) - [All operations](https://skmtc.dev/openziti/apis/ziti-edge-client/llms.txt) - [OpenAPI document](https://skmtc.dev/openziti/apis/ziti-edge-client/revisions/f7b51eaafbbb?raw)