---
title: "Remove a MFA factor from a user."
method: DELETE
path: "/factors/{factorId}"
tags: ["user"]
---

# Remove a MFA factor from a user.

`DELETE /factors/{factorId}`

## Path parameters

- `factorId` string, uuid, required

## Response `200`

This MFA factor is removed (unenrolled) and cannot be used for increasing the AAL level of user's sessions. Client libraries should use the `POST /token?grant_type=refresh_token` endpoint to get a new access and refresh token with a decreased AAL.

- object
  - `id` string, uuid

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).

## Changes

- **2025-02-07** `4d0f1a6c1ad9` — 1 info
  - added the optional property `error_code` to the response with the `400` status
- **2023-12-13** `77f9aeb9339a` — 1 info
  - added the optional property `weak_password` to the response with the `400` status
- **2023-02-01** `144a34ca6d74` — 2 warning
  - removed the optional property `error_code` from the response with the `400` status
  - removed the optional property `weak_password` from the response with the `400` status

[Change history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/factors/:factorId/delete.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)