2fa.* events report each step of multifactor authentication, from the options presented to the user through to completion or recovery. They carry the common fields every user verification event carries, and no object field.

See User verification events for the delivery envelope, the fields every event carries, and the full list of 2fa.* event types.

Example payload

2fa.complete

{
  "host": "events.idmelabs.com",
  "source": "idme:dev",
  "sourcetype": "idme:auth",
  "event": {
    "event_id": "2737913b-4f42-4140-a474-39720eaf9cd5",
    "event": "2fa.complete",
    "uuid": "c3850702f02f4f948cede41610c2a715",
    "user_email": "xbzi.gqcv@gmail.com",
    "application_name": "Auth Portal",
    "ipaddress": "55.55.55.55",
    "device_fingerprint": "lu2pFqAQyLIr0MqVpDEV",
    "useragent": "Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1",
    "created_at": "2026-07-04T13:12:26.877091Z",
    "eid": null,
    "app_id": null,
    "state": null
  }
}

New fields may be added to 2fa.* events without a breaking change. Ignore fields you do not recognize rather than rejecting the payload.