Every 2fa.* event carries an authenticator on event.object: the multifactor authentication method involved in the event.

See User verification events for the delivery envelope, the fields every event carries, and the full list of 2fa.* event types.

The authenticator resource

Field	Type	Description	Example value
`type`	string	Always `authenticator`	`authenticator`
`method`	string	The multifactor method used	`text_message`

Example payload

2fa.complete

{
  "data": {
    "source": "idme:dev",
    "sourcetype": "idme:auth",
    "event": {
      "event_id": "2737913b-4f42-4140-a474-39720eaf9cd5",
      "event": "2fa.complete",
      "uuid": "c3850702f02f4f948cede41610c2a715",
      "user_email": "xbzi.gqcv@gmail.com",
      "application_name": "Auth Portal",
      "ipaddress": "55.55.55.55",
      "device_fingerprint": "lu2pFqAQyLIr0MqVpDEV",
      "useragent": "Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1",
      "created_at": "2026-07-04T13:12:26.877091Z",
      "eid": null,
      "app_id": null,
      "state": null,
      "object": {
        "type": "authenticator",
        "method": "text_message"
      }
    }
  }
}

New fields may be added to the authenticator resource without a breaking change. Ignore fields you do not recognize rather than rejecting the payload.