---
title: "Update a user's MFA factor."
method: PUT
path: "/admin/users/{userId}/factors/{factorId}"
tags: ["admin"]
---

# Update a user's MFA factor.

`PUT /admin/users/{userId}/factors/{factorId}`

## Request body

- object

## Response `200`

User's MFA factor.

- MFAFactorSchema — Represents a MFA factor.
  - `id` string, uuid
  - `status` string — Usually one of: - verified - unverified
  - `friendly_name` string
  - `factor_type` string — Usually one of: - totp - phone - webauthn
  - `webauthn_credential` string
  - `phone` string, phone, nullable
  - `created_at` string, date-time
  - `updated_at` string, date-time
  - `last_challenged_at` string, date-time, nullable

## Other responses

- `401` — HTTP Unauthorized response.
- `403` — HTTP Forbidden response.
- `404` — There is no such user and/or factor.

## Changes

- **2025-09-24** `a222d9459767` — 1 warning, 1 info
  - removed the optional property `web_authn_credential` from the response with the `200` status
  - added the optional property `webauthn_credential` to the response with the `200` status
- **2025-02-07** `4d0f1a6c1ad9` — 1 breaking, 3 info
  - the `web_authn_credential` response's property type/format changed from `jsonb`/`` to `string`/`` for status `200`
  - added the optional property `error_code` to the response with the `401` status
  - added the optional property `error_code` to the response with the `403` status
  - added the optional property `error_code` to the response with the `404` status
- **2024-10-11** `f89bf040698f` — 1 breaking, 4 info
  - the response property `phone` became nullable for the status `200`
  - added the optional property `created_at` to the response with the `200` status
  - added the optional property `last_challenged_at` to the response with the `200` status
  - added the optional property `updated_at` to the response with the `200` status
  - …1 more
- **2024-08-01** `b33a9ea8493e` — 1 info
  - added the optional property `phone` to the response with the `200` status
- **2023-12-13** `77f9aeb9339a` — 3 info
  - added the optional property `weak_password` to the response with the `401` status
  - added the optional property `weak_password` to the response with the `403` status
  - added the optional property `weak_password` to the response with the `404` status

[Full history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/admin/users/:userId/factors/:factorId/put.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)