docs/data/reusables/user-settings/user-api.md

If a request URL does not include a {username} parameter then the response will be for the signed-in user (and you must pass authentication information with your request). Additional private information, such as whether a user has two-factor authentication enabled, is included when authenticated through{% ifversion ghes %} Basic Authentication or{% endif %} OAuth with the user scope.