Auth

Remove Mfa Method

Soft-disable a single MFA method.

Per-method removal — the existence of multiple authenticators is the whole point of letting a user have e.g. both Authy and a password-manager TOTP. We block removal of the last active method here so the user has exactly one explicit path to MFA-off (the danger-zone "Disable two-factor" button), which also wipes recovery codes. Without that block, a user clicking "Remove" on their only method would be silently full-disabled — surprising, and a UX cliff edge.

Requires password re-auth so a stolen session JWT alone can't erode a user's MFA posture.

post/auth/mfa/methods/{method_id}/remove

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/auth/mfa/methods/{method_id}/remove
  • Auth: HTTP bearer

Path parameters

method_idinteger required

Headers

API-Version'1'

Major API version. Omit or send 1 for the current v1 surface. Retired operations use RFC 9745 Deprecation and RFC 8594 Sunset headers.

Request body

passwordstring required

Response

Successful Response

msgstring required

Changes

No recorded changes to this operation across all 1 revision of this API.