Remove the time-based one-time password factor

DELETE/api/v1/auth/mfa/totp

Removes the factor and every recovery code that went with it — recovery codes exist only to recover a factor, so leaving them would keep live bearer secrets for something that no longer exists.

Removal requires the current password and a current code (TOTP or recovery). Either alone would let a stolen session or a stolen phone take the protection off by itself.

An account with no confirmed factor receives 409 mfa_not_enabled; an unconfirmed enrolment is not a factor for this purpose.

Header Parameters

X-CSRF-TokenRequired

string·min 43·max 43

Session-bound CSRF token. It must exactly match the __Host-assign_csrf cookie sent with the request.

Request Body

application/json

current_passwordRequired

string <password>·min 1·max 128

codeRequired

string <password>·min 1·max 64

Either a six-digit TOTP code or one of the account's recovery codes. Recovery codes are matched after stripping spaces and hyphens and upper-casing, so a code read off paper matches however it was grouped.

Responses

Authentication · Conventions and errors · API guides · Resource reference

Remove the time-based one-time password factor