Book a demo

list_user_factors

List the second factors of an org's members

read collection tenant-private since 2026-10-01

Lists every member of the org with the kinds of factor they have enrolled (totp, sms, backup_code, passkey), whether one is a second factor that meets an MFA requirement, whether the org's MFA requirement reaches them, and when their grace ends. Ordered by user id. Never a phone number, a code or a credential.

Contract

shape
collection
authority
read
evidence
none
subscription
false
permission
any one of: staff.read (the staff role staff_read held in the Internal org, tradehq_role.staff_role); org.admin (carried by the caller's role template in the org `org_id`); account.owner (account role owner or higher in the account of the org `org_id`); a deactivated caller is refused first
idempotency
safe
emits
none
MCP tool
list_user_factors
REST
POST https://api.containertradehq.com/v1/cap/list_user_factors

Idempotency: a read: calling again changes nothing

Inputs

nametyperequiredvalidation
org_idorg_idrequiredtradehq-org-id; 1 to 20 characters
The org whose members to list.

Paginated: next next_after · page_max 5000 · walk_max 5000 · ceiling declared

Response

  • items · object[]
  • next_after · stringnull · Pass as `after` for the next page; null on the last one.
Full JSON Schema 
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "user_id": {
            "type": "string",
            "minLength": 1,
            "maxLength": 20,
            "pattern": "^[A-Za-z0-9_-]{1,20}$",
            "format": "tradehq-user-id",
            "description": "The member.",
            "x-data-class": "operational"
          },
          "factors": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "The factor kinds they have enrolled: totp, sms, backup_code, passkey.",
            "x-data-class": "operational"
          },
          "second_factor": {
            "type": "boolean",
            "description": "Whether one of them is a second factor that meets an MFA requirement (totp or sms).",
            "x-data-class": "operational"
          },
          "policy_applies": {
            "type": "boolean",
            "description": "Whether the org's MFA requirement reaches this member.",
            "x-data-class": "operational"
          },
          "only_org": {
            "type": "boolean",
            "description": "Whether this org is the member's only org: the one case an org admin may reset their MFA (reset_user_mfa), which the Members row menu reads to offer it.",
            "x-data-class": "operational"
          },
          "grace_ends_at": {
            "type": [
              "string",
              "null"
            ],
            "format": "date-time",
            "description": "When their grace ends, for a member the requirement reaches; null otherwise.",
            "x-data-class": "operational"
          }
        },
        "required": [
          "user_id",
          "factors",
          "second_factor",
          "policy_applies",
          "only_org",
          "grace_ends_at"
        ],
        "additionalProperties": false
      },
      "maxItems": 5000
    },
    "next_after": {
      "type": [
        "string",
        "null"
      ],
      "description": "Pass as `after` for the next page; null on the last one."
    }
  },
  "required": [
    "items",
    "next_after"
  ],
  "additionalProperties": false
}

Refusals

The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.

Surfaces

DesktopF
MobileF
APIF
MCPF
VoiceD4
PushN
OneBoxN
OutboundN
  • Voice: degraded: visualization
  • Push: emits nothing
  • OneBox: no document originates a member's factors
  • Outbound: crosses to no counterparty

Events

None emitted.

Related

None.