---
title: "POST /api/ee/mfa/admin/remove"
method: POST
path: "/api/ee/mfa/admin/remove"
tags: ["/api/ee/mfa"]
---

# POST /api/ee/mfa/admin/remove

`POST /api/ee/mfa/admin/remove`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/ee/mfa/admin/remove`
- Auth: API key in header `X-API-Key`

Admin: remove *another* user's two-factor enrollment entirely — the lockout escape hatch for a
  lost authenticator with no recovery codes. Never feature-gated (a lapsed license must not make
  lockouts permanent). The affected user is notified by email. They re-enroll from scratch — there
  is nothing to "reset", the secret lives on their device.

  Removing your *own* enrollment is deliberately refused here: this is a user-management endpoint
  that takes no second factor (the target can't produce one — that's why an admin is removing it),
  and the admin UI never collects a code. Self-removal goes through the normal Security page, which
  re-auths with a fresh factor via `/disable`. Without this guard a hijacked admin session could
  strip its own 2FA with only a cookie, turning transient access into a permanent password bypass.

## Request body

- object
  - `user_id` integer, required: value must be an integer greater than zero.

## Response `2XX`

Successful response

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/ee/mfa/admin/remove/post.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)