---
title: "List two step members (v2)"
method: GET
path: "/api/v1/account/two-step-members-v2"
tags: ["account"]
---

# List two step members (v2)

`GET /api/v1/account/two-step-members-v2`

## Request

- Base URL: `https://point11.ai`
- URL: `https://point11.ai/api/v1/account/two-step-members-v2`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.point11.ai/oauth2/authorize`, token URL `https://auth.point11.ai/oauth2/token`)

List the organization's members with their two-step verification posture, for owners and admins: whether each has it on, which kinds of method (passkey, passkey that can't sync, authenticator app, text message), whether any is phishing-resistant, whether they sign in through the organization's single sign-on, when they last answered a second step, how many browsers they trust, and how many of the organization's API keys they minted without a second step.

## Query parameters

- `limit` integer: Number of items to return (1–1000)
- `cursor` string: Opaque cursor returned as nextCursor by the previous page

## Headers

- `Point11-Organization` string, uuid

## Response `200`

Success.

- AccountTwoStepMembersListV2Response
  - `data` object[], required
    - `id` string, uuid, required: The member's user id
    - `email` string, required
    - `name` string, nullable, required
    - `role` string, required
    - `hasTwoStep` boolean, required: Whether they have two-step verification on
    - `methodKinds` string[], required: The kinds of method they hold: a passkey, security_key (a passkey its authenticator reports can't sync, such as a security key), an authenticator app (totp) or a text message (sms)
    - `phishingResistant` boolean, required: Whether they hold a passkey or security key, which a phishing page cannot relay
    - `ssoExempt` boolean, required: Whether their address is on one of the organization's verified single sign-on domains, so they sign in through its connection, whose identity provider asks its own second step
    - `lastAnsweredAt` string, date-time, nullable, required: When any of their methods last answered a second step
    - `trustedBrowsers` integer, required: How many browsers they trust to skip the second step now
    - `apiKeysWithoutTwoStep` integer, required: How many of the organization's live API keys they created without a second step; the requirement refuses them once its grace period ends
  - `nextCursor` string, nullable, required

## Other responses

- `400`: The input, query, or Idempotency-Key is invalid.
- `401`: The bearer is missing, expired, or not accepted.
- `403`: The credential lacks the operation's scope or role, or the operation needs a different door.
- `404`: The resource or organization does not exist for this caller.
- `405`: This path takes another HTTP method, named in `Allow`.
- `409`: The request conflicts with current state or with prior use of its Idempotency-Key.
- `413`: The request, or the answer it asks for, is too large; narrow it.
- `429`: The credential's rate budget is spent; retry after `Retry-After` seconds.
- `500`: An unexpected server failure; retry later. Only `request_id` identifies it.
- `503`: A dependency is temporarily unavailable; retry after `Retry-After` seconds.
- `default`: Another status a product answers for its own refusal (for example `415` for an unsupported attachment); branch on `code`.

---

[API](https://skmtc.dev/point11/apis/point11-api.md) · [All operations](https://skmtc.dev/point11/apis/point11-api/llms.txt) · [OpenAPI document](https://skmtc.dev/point11/apis/point11-api/revisions/5241805fe425?raw)