Get Two-Factor Status - Pacifica

POST /api/v1/account/2fa/status

Returns whether two-factor authentication is on, the account’s factors, and the number of unused recovery keys.

Operation Type (for Signing)

Header Field	Type	Content
`"type"`	string	`"two_factor_status"`

Request Body

Field	Type	Need	Description	Example
`”account”`	string	required	User’s wallet address	`42trU9A5…`
`“signature”`	string	required	Cryptographic signature	`5j1Vy9Uq…`
`“timestamp”`	integer	required	Current timestamp in milliseconds	`1716200000000`
`”agent_wallet”`	string	optional	Agent wallet address	`69trU9A5…`
`“expiry_window”`	integer	optional	Signature expiry in milliseconds	`30000`

{
  "account": "42trU9A5...",
  "signature": "5j1Vy9Uq...",
  "timestamp": 1716200000000,
  "agent_wallet": "69trU9A5...",
  "expiry_window": 30000
}

You can sign this request with the account key or with an agent wallet. The account must be a main account.

Signing

The data object is empty. For the request above, the message to sign is:

{"data":{},"expiry_window":30000,"timestamp":1716200000000,"type":"two_factor_status"}

Response

Status 200: Success

{
  "success": true,
  "data": {
    "protected_actions": ["withdrawal"],
    "factors": [
      {
        "id": "c9f0f895-fb98-4b91-a3b5-6e9e7c2f1d4a",
        "kind": "totp",
        "label": "Authenticator app",
        "created_at": "2026-10-10T12:00:00.123456Z",
        "last_used_at": "2026-10-12T08:30:15.654321Z"
      }
    ],
    "recovery_keys_remaining": 10
  },
  "error": null,
  "code": null
}

Field	Type	Description
`'protected_actions'`	array	Actions that need a proof. `["withdrawal"]` while 2FA is on. Empty while 2FA is off
`'factors'`	array	The account’s factors. See below
`'recovery_keys_remaining'`	integer	Number of unused recovery keys

While 2FA is on, factor changes also need a proof. protected_actions lists only withdrawals. Each entry in factors has these fields:

Field	Type	Description
`'id'`	string	Factor ID (UUID). Send it to Rename factor or Remove factor
`'kind'`	string	`"totp"`, `"passkey"`, or `"security_key"`
`'label'`	string	Your name for the factor
`'created_at'`	string	When the factor was added (RFC 3339)
`'last_used_at'`	string or null	When a proof from this factor last passed (RFC 3339). `null` if the factor has not made a proof yet

An account that never turned on 2FA returns empty lists and "recovery_keys_remaining": 0.

Status 400: Invalid request parameters or signature
Status 403: The account is a subaccount, or it does not exist
Status 500: Internal server error
Status 503: The two-factor service is unavailable. Retry later

Code Example (Python)

import requests

payload = {
    "account": "42trU9A5...",
    "signature": "5j1Vy9Uq...",
    "timestamp": 1716200000000
}

response = requests.post(
    "/api/v1/account/2fa/status",
    json=payload,
    headers={"Content-Type": "application/json"}
)

data = response.json()