Organizations

Revoke an approved administrator MFA approval using revision CAS

Moves an APPROVED approval, including one granted automatically to a device that existed before activation, to REJECTED. The reason is required and is shown to the user on their next sign-in. Issued tokens stay valid until they expire. The user's silent MFA key on the device is removed; TOTP and passkeys are kept.

post/organizations/{organizationId}/admin-mfa-approval/approvals/{approvalId}/revoke

Request

  • Base URL: https://api.xfa.tech
  • URL: https://api.xfa.tech/organizations/{organizationId}/admin-mfa-approval/approvals/{approvalId}/revoke
  • Auth: HTTP bearer

Path parameters

organizationIdstring required
approvalIdstring required

Request body

expected_revisioninteger required
reasonstring required

Response

Rejected approval, including an already-rejected approval (idempotent)

requester_emailstring email

Verified sign-in email of the applicant. Omitted when not yet recorded; never inferred from the device owner.

approval_idstring required
canonical_user_idstring required
device_idstring required
status'PENDING' | 'APPROVED' | 'REJECTED' required
revisioninteger required
requested_atstring date-time
updated_atstring date-time required

Last change, including a sign-in that refreshes the request context.

decided_atstring date-time

When an admin (or turning approval off) last decided; absent while never decided.

rejection_reasonstring

The reason of the latest rejection, only for REJECTED approvals. It is the text the user sees on sign-in; who decided stays out of the list.

resolution_source'MANAGED_DEVICE' | 'ADMIN' | 'POLICY_OFF'

What resolved the approval: automatic approval of a managed device, an administrator, or turning approval off. Absent while never decided.

setting_versioninteger required
grandfatheredboolean required
created_atstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.