---
title: "Remove Mfa Method"
method: POST
path: "/auth/mfa/methods/{method_id}/remove"
tags: ["Auth"]
---

# Remove Mfa Method

`POST /auth/mfa/methods/{method_id}/remove`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/auth/mfa/methods/{method_id}/remove`
- Auth: HTTP bearer

Soft-disable a single MFA method.

Per-method removal — the existence of multiple authenticators is
the whole point of letting a user have e.g. both Authy and a
password-manager TOTP. We block removal of the **last** active
method here so the user has exactly one explicit path to MFA-off
(the danger-zone "Disable two-factor" button), which also wipes
recovery codes. Without that block, a user clicking "Remove" on
their only method would be silently full-disabled — surprising,
and a UX cliff edge.

Requires password re-auth so a stolen session JWT alone can't
erode a user's MFA posture.

## Path parameters

- `method_id` integer, required

## Headers

- `API-Version` '1'

## Request body

- PasswordReauthRequest: POST body for /auth/mfa/disable and /auth/mfa/recovery-codes/regenerate. Re-authentication with the password (which they just supplied at login) is a deliberately lower bar than a fresh MFA step-up — that lands in Phase 3.
  - `password` string, required

## Response `200`

Successful Response

- SuccessPayload
  - `msg` string, required
  - `data` union
    - object
    - unknown[]
      - unknown
    - string

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/totalparks/apis/total-parks-public-api.md) · [All operations](https://skmtc.dev/totalparks/apis/total-parks-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/totalparks/apis/total-parks-public-api/revisions/dcb4c822e2c6?raw)