---
title: "Remove another user's second factor (admin only)."
method: DELETE
path: "/users/{user_id}/mfa"
tags: ["Users"]
---

# Remove another user's second factor (admin only).

`DELETE /users/{user_id}/mfa`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/users/{user_id}/mfa`
- Auth: HTTP bearer

The recovery path for a user who lost both their authenticator and their
recovery codes: their TOTP secret, recovery codes and second-factor
lockout state are deleted and every session they have is revoked, so they
can sign in with their password alone and enroll again. Their password,
roles and API keys are left alone.

Gated exactly like `POST /users/{user_id}/password`: `users:manage`, not
on yourself (use `DELETE /users/me/mfa`, which takes a code), and a recent
step-up for an MFA-enrolled administrator. When the instance has no other
admin to ask, `temps reset-admin-password --clear-mfa` does the same
offline.

## Path parameters

- `user_id` integer, required

## Response `200`

MFA removed and the user's sessions revoked

- ResetUserMfaResponse: Returned when an administrator removes another user's second factor.
  - `mfa_enabled` boolean, required: Always false: the user's TOTP secret and recovery codes are gone.
  - `password_sign_in_blocked` boolean, required: True when this instance requires MFA for admins (`require_mfa_for_admins`) and the user is an admin: until they enroll again they cannot sign in with a password, so they must sign in through SSO, or the setting must be turned off while they re-enroll.
  - `sessions_revoked` integer, required: How many of the user's sessions were signed out by the reset.

## Other responses

- `401`: Unauthorized
- `403`: users:manage required, or attempted to reset your own MFA (use DELETE /users/me/mfa)
- `404`: User not found
- `409`: User is deleted, or has no MFA enrolled
- `428`: Recent identity verification (step-up) required
- `500`: Internal server error

## Changes

> 98 revisions in range; 1 not diffed.

- **2026-10-23** `fdfa2df06ae7`: 1 info
  - endpoint added
- **2026-10-22** `317a2fc156d8`: 1 breaking
  - api path removed without deprecation
- **2026-10-22** `3d4dc1f5748b`: 1 info
  - endpoint added
- **2026-10-22** `eb81785fa098`: 1 breaking
  - api path removed without deprecation
- **2026-10-22** `7d41b820a372`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/gotempsh/apis/temps/changes/users/:user_id/mfa/delete.md)

---

[API](https://skmtc.dev/gotempsh/apis/temps.md) - [All operations](https://skmtc.dev/gotempsh/apis/temps/llms.txt) - [OpenAPI document](https://skmtc.dev/gotempsh/apis/temps/revisions/fdfa2df06ae7?raw)