Users

Remove your own MFA enrollment.

Changed on Oct 10, 2026

Removes the calling key's own user's MFA, which takes a valid code so a stolen session key cannot turn MFA off. A bad code counts toward the lock. A user who has lost the device asks an administrator, who uses DELETE /api/users/{username}/mfa. Requires the scope but not an administrator. Recorded as a user_mfa_removed audit event. Requires the users:write scope.

post/api/users/me/mfa/remove

Request

Base URL
/ (relative, and the document was published on a file host, not at the API’s origin)
URL
/api/users/me/mfa/remove
Auth
HTTP bearer

Headers

Authorizationstring required

Request body

codestring

Response

MFA was removed.

Changes

Oct 10, 2026c4f85daa9208 Revision changes
- info
  added the non-success response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
- info
  added the optional property to the response with the status
Oct 5, 20264082c17721d8 Revision changes
- breaking
  removed the media type */* for the response with the status
- breaking
  removed the media type */* for the response with the status
- breaking
  removed the media type */* for the response with the status
- breaking
  removed the media type */* for the response with the status
- breaking
  removed the media type */* for the response with the status
- breaking
  removed the media type */* for the response with the status
- info
  added the media type application/json for the response with the status
- info
  added the media type application/json for the response with the status
- info
  added the media type application/json for the response with the status
- info
  added the media type application/json for the response with the status
- info
  added the media type application/json for the response with the status
- info
  added the media type application/json for the response with the status

Operation history (3 revisions)