diff --git a/pkg/user/totp.go b/pkg/user/totp.go
index 66abb813c..e18948443 100644
--- a/pkg/user/totp.go
+++ b/pkg/user/totp.go
@@ -37,11 +37,11 @@ import (
 type TOTP struct {
 	ID     int64  `xorm:"bigint autoincr not null unique pk" json:"-"`
 	UserID int64  `xorm:"bigint not null" json:"-"`
-	Secret string `xorm:"text not null" json:"secret"`
+	Secret string `xorm:"text not null" json:"secret" readOnly:"true" doc:"The shared secret used to generate passcodes, generated by the server on enrollment."`
 	// The totp entry will only be enabled after the user verified they have a working totp setup.
-	Enabled bool `xorm:"null" json:"enabled"`
+	Enabled bool `xorm:"null" json:"enabled" readOnly:"true" doc:"Whether totp is fully activated. Set to true only after the user confirms a passcode."`
 	// The totp url used to be able to enroll the user later
-	URL string `xorm:"text null" json:"url"`
+	URL string `xorm:"text null" json:"url" readOnly:"true" doc:"The otpauth:// url, generated by the server, used to enroll the user in an authenticator app."`
 }
 
 // TableName holds the table name for totp secrets