17 days ago
The command below shows we have has2FAEnforcement=true but still 2users in usersWithout2FA. This makes compliance a little bit difficult as it seems contradictory. Then in the UI, it shows 2FA status enabled for all members. So what is the logic here?
curl -s -X POST https://backboard.railway.com/graphql/v2 \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-d '{"query":"query { me { workspaces { name has2FAEnforcement usersWithout2FA members { email role } } } twoFactorInfo { isVerified } }"}' | jq .
3 Replies
17 days ago
The has2FAEnforcement flag is the authoritative enforcement control, and per our 2FA Enforcement docs, when it is enabled members are blocked from accessing the workspace until they have MFA configured. Railway supports two MFA methods (authenticator app and passkeys), and the dashboard reflects both when showing 2FA status as enabled for all members. The usersWithout2FA API field is not documented in detail, so we cannot confirm its exact counting logic or whether it accounts for both MFA methods the same way the dashboard does.
Status changed to Awaiting User Response Railway • 17 days ago
Railway
The `has2FAEnforcement` flag is the authoritative enforcement control, and per our [2FA Enforcement docs](https://docs.railway.com/access/two-factor-enforcement), when it is enabled members are blocked from accessing the workspace until they have MFA configured. Railway supports two MFA methods (authenticator app and passkeys), and the dashboard reflects both when showing 2FA status as enabled for all members. The `usersWithout2FA` API field is not documented in detail, so we cannot confirm its exact counting logic or whether it accounts for both MFA methods the same way the dashboard does.
17 days ago
Okay, it would be nice to confirm what usersWithout2FA means exactly
Status changed to Awaiting Railway Response Railway • 17 days ago
17 days ago
The usersWithout2FA field only checks whether a member has a verified authenticator app (TOTP) set up. It does not account for passkeys. The enforcement gate and the dashboard, on the other hand, treat either method (authenticator app or passkey) as satisfying the 2FA requirement.
So the two members showing up in usersWithout2FA most likely have passkeys configured but no authenticator app. They are fully protected and pass enforcement, but this API field does not recognize passkeys as 2FA. For compliance purposes, has2FAEnforcement and the dashboard status are the accurate signals.
Status changed to Awaiting User Response Railway • 17 days ago
Status changed to Solved sam-a • 17 days ago