docs/data/reusables/user-settings/user-api.md

If a request URL does not include a {username} parameter then the response will be for the signed-in user (and you must pass authentication information with your request).{% ifversion fpt or ghes or ghec %} Additional private information, such as whether a user has two-factor authentication enabled, is included when authenticated through Basic Authentication or OAuth with the user scope.{% endif %}