---
title: "Remove selected MFA registrations for one user"
method: DELETE
path: "/organizations/{organizationId}/users/{email}/mfa"
---

# Remove selected MFA registrations for one user

`DELETE /organizations/{organizationId}/users/{email}/mfa`

## Request

- Base URL: `https://api.xfa.tech`
- URL: `https://api.xfa.tech/organizations/{organizationId}/users/{email}/mfa`
- Auth: HTTP bearer

Administrator only, with the existing MFA gate. Requires a scoped revision from the overview. Preserves other methods and existing sessions. The silent method without deviceId and credentialId removes all silent MFA for this user only. The passkey method includes security keys; credentialId selects one registration, including a silent MFA registration without a device.

## Request body

- MfaRemoval
  - `method` 'totp' | 'passkey' | 'silent', required
  - `revision` string, required
  - `credentialId` string: Unpadded base64url ID; selects one passkey/security key, or one silent MFA registration without a device. Omit to remove the whole method.
  - `deviceId` string: Only for silent MFA on one device. Omit both deviceId and credentialId to remove all silent MFA for this user.

## Response `204`

Removed or already absent

## Other responses

- `400`: Invalid selection
- `403`: Not authorized
- `409`: Registration changed; refresh and confirm again

---

[API](https://skmtc.dev/xfa/apis/xfa-api.md) · [All operations](https://skmtc.dev/xfa/apis/xfa-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfa/apis/xfa-api/revisions/1a1be0e8972b?raw)