---
title: "Admin Reset User Mfa"
method: POST
path: "/api/auth/admin/users/{user_id}/mfa/reset"
tags: ["Authentication"]
---

# Admin Reset User Mfa

`POST /api/auth/admin/users/{user_id}/mfa/reset`

## Request

- Base URL: `https://app.getdot.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.getdot.ai/api/auth/admin/users/{user_id}/mfa/reset`
- Auth: one of:
  - API key in header `X-API-KEY`
  - API key in cookie `Authorization`
  - OAuth 2 (password, token URL `/api/auth/token`)

Admin-only: wipe a user's MFA enrollment so they can re-enroll on next
login. Used when a user has lost their authenticator AND their recovery
codes (or when an admin needs to revoke MFA for compliance reasons).

Bumps token_version + clears access_tokens to invalidate any live
sessions of the target user — losing MFA is a security-relevant change.

Cross-org admins can't reach this: the route returns 404 if the target
isn't in the admin's org.

## Path parameters

- `user_id` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/getdot/apis/dot-api-2.md) · [All operations](https://skmtc.dev/getdot/apis/dot-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/getdot/apis/dot-api-2/revisions/d26fe7163a7f?raw)