TOTP status

GET /v1/security/totp/status

Projection of /auth/me through the agent's normalizeTotpStatus adapter. totp_enabled is the flag that decides which second factor a withdrawal needs. withdraw_enabled is the account's stored preference, which upstream's withdraw guard does not read. new_device_enabled gates first-login TOTP. has_secret reports whether an authenticator is still bound: disabling 2FA keeps the secret, so totp_enabled: false with has_secret: true means it can be switched back on with the same authenticator, while unbinding clears both. Callers MUST assume nothing when schema_source === "indeterminate": the values are fallbacks, not readings.

Response body

{ "totp_enabled": true, "withdraw_enabled": true, "new_device_enabled": false, "has_secret": true, "schema_source": "known" }