Users

Remove another user's second factor (admin only).

Changed on

The recovery path for a user who lost both their authenticator and their recovery codes: their TOTP secret, recovery codes and second-factor lockout state are deleted and every session they have is revoked, so they can sign in with their password alone and enroll again. Their password, roles and API keys are left alone.

Gated exactly like POST /users/{user_id}/password: users:manage, not on yourself (use DELETE /users/me/mfa, which takes a code), and a recent step-up for an MFA-enrolled administrator. When the instance has no other admin to ask, temps reset-admin-password --clear-mfa does the same offline.

delete/users/{user_id}/mfa

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/users/{user_id}/mfa
  • Auth: HTTP bearer

Path parameters

user_idinteger required

User ID

Response

MFA removed and the user's sessions revoked

mfa_enabledboolean required

Always false: the user's TOTP secret and recovery codes are gone.

password_sign_in_blockedboolean required

True when this instance requires MFA for admins (require_mfa_for_admins) and the user is an admin: until they enroll again they cannot sign in with a password, so they must sign in through SSO, or the setting must be turned off while they re-enroll.

sessions_revokedinteger required

How many of the user's sessions were signed out by the reset.

Example response

{
  "sessions_revoked": 2
}

Changes