---
title: "Get two step policy"
method: GET
path: "/api/v1/account/two-step-policy/{id}"
tags: ["account"]
---

# Get two step policy

`GET /api/v1/account/two-step-policy/{id}`

## Request

- Base URL: `https://point11.ai`
- URL: `https://point11.ai/api/v1/account/two-step-policy/{id}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.point11.ai/oauth2/authorize`, token URL `https://auth.point11.ai/oauth2/token`)

Read whether the organization requires two-step verification, until when a member without it is still let in, which methods count, and how many days a trusted browser may skip the second step.

## Path parameters

- `id` string, required: The organization id

## Headers

- `Point11-Organization` string, uuid

## Response `200`

Success.

- AccountTwoStepPolicyGetResponse
  - `required` boolean, required: Whether every member must have two-step verification
  - `graceEndsAt` string, date-time, nullable, required: While required: when members without it stop being let in
  - `allowedMethods` string[], required: The methods that satisfy the requirement
  - `trustedBrowserDays` union, required: How many days a trusted browser may skip the second step here; 0 trusts none
    - 0
    - 7
    - 30
  - `recoveryCodesCount` boolean, required: Whether a recovery code satisfies the requirement
  - `deviceBoundPasskeys` boolean, required: Whether only a passkey that can't sync, by its authenticator's own unattested report (such as a security key), counts as a passkey
  - `maxSessionHours` 8 | 12 | 24 | 72, nullable, required: How many hours one sign-in may act here; null is WorkOS's 7 days
  - `apiKeyMaxDays` 30 | 90 | 180, nullable, required: How many days a new API key may live; null is a year

## Other responses

- `400`: The input, query, or Idempotency-Key is invalid.
- `401`: The bearer is missing, expired, or not accepted.
- `403`: The credential lacks the operation's scope or role, or the operation needs a different door.
- `404`: The resource or organization does not exist for this caller.
- `405`: This path takes another HTTP method, named in `Allow`.
- `409`: The request conflicts with current state or with prior use of its Idempotency-Key.
- `413`: The request, or the answer it asks for, is too large; narrow it.
- `429`: The credential's rate budget is spent; retry after `Retry-After` seconds.
- `500`: An unexpected server failure; retry later. Only `request_id` identifies it.
- `503`: A dependency is temporarily unavailable; retry after `Retry-After` seconds.
- `default`: Another status a product answers for its own refusal (for example `415` for an unsupported attachment); branch on `code`.

---

[API](https://skmtc.dev/point11/apis/point11-api.md) · [All operations](https://skmtc.dev/point11/apis/point11-api/llms.txt) · [OpenAPI document](https://skmtc.dev/point11/apis/point11-api/revisions/36a84c7aca11?raw)