---
title: "List all of the MFA factors for a user."
method: GET
path: "/admin/users/{userId}/factors"
tags: ["admin"]
---

# List all of the MFA factors for a user.

`GET /admin/users/{userId}/factors`

## Response `200`

User's MFA factors.

- MFAFactorSchema[]
  - `id` string, uuid
  - `status` string — Usually one of: - verified - unverified
  - `friendly_name` string
  - `factor_type` string — Usually one of: - totp - phone - webauthn
  - `webauthn_credential` string
  - `phone` string, phone, nullable
  - `created_at` string, date-time
  - `updated_at` string, date-time
  - `last_challenged_at` string, date-time, nullable

## Other responses

- `401` — HTTP Unauthorized response.
- `403` — HTTP Forbidden response.
- `404` — There is no such user.

## Changes

- **2025-09-24** `a222d9459767` — 1 warning, 1 info
  - removed the optional property `items/web_authn_credential` from the response with the `200` status
  - added the optional property `items/webauthn_credential` to the response with the `200` status
- **2025-02-07** `4d0f1a6c1ad9` — 1 breaking, 3 info
  - the `items/web_authn_credential` response's property type/format changed from `jsonb`/`` to `string`/`` for status `200`
  - added the optional property `error_code` to the response with the `401` status
  - added the optional property `error_code` to the response with the `403` status
  - added the optional property `error_code` to the response with the `404` status
- **2024-10-11** `f89bf040698f` — 1 breaking, 4 info
  - the response property `items/phone` became nullable for the status `200`
  - added the optional property `items/created_at` to the response with the `200` status
  - added the optional property `items/last_challenged_at` to the response with the `200` status
  - added the optional property `items/updated_at` to the response with the `200` status
  - …1 more
- **2024-08-01** `b33a9ea8493e` — 1 info
  - added the optional property `items/phone` to the response with the `200` status
- …earlier changes not shown

[Full history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/admin/users/:userId/factors/get.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)