---
title: "Disable user MFA"
method: POST
path: "/api/admin/users/{id}/disable-2fa"
tags: ["Admin"]
---

# Disable user MFA

`POST /api/admin/users/{id}/disable-2fa`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/admin/users/{id}/disable-2fa`
- Auth: API key in cookie `hk_token`

Owner-only recovery action that clears TOTP, passkeys, pending MFA challenges, and remember-me sessions for the target user.

## Path parameters

- `id` string, uuid, required

## Response `200`

Disable user MFA response

- AdminDisableUserMFAResponse
  - `passkeys_deleted` integer, required
  - `sessions_invalidated` integer, required
  - `status` string, required
  - `totp_disabled` boolean, required

## Other responses

- `403`: Forbidden
- `404`: Not found

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)