DELETE/api/user/mfa/totp/{factor_id}Authenticated

Remove a TOTP factor

Deletes one of the caller's authenticator-app factors (verified or still pending). The request must carry a current code from that very factor as proof of control. Removing the last verified factor also discards the account's recovery codes. A security alert e-mail is sent.

operationId delete_api_user_mfa_totp_factor_idMulti-factor authentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Path parameters

NameTypeDescription
factor_id*string (uuid)

MFA factor id, as returned by the enrollment endpoints and GET /api/user/mfa/status

Request body

Required — A current 6-digit code generated by the factor being removed.

application/json
MfaRemoveTotpFactorRequest
PropertyTypeDescription
code*string

pattern: ^\d{6}$/u

JSONExample
"code""string"

Responses

application/json
MfaFactorRemoved
PropertyTypeDescription
success*true
JSONExample
"success"true

Example request

bashcurl
curl -X DELETE 'https://auth.schemavaults.com/api/user/mfa/totp/<factor_id>' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "code": "string"
}'
DELETE /api/user/mfa/totp/{factor_id} | SchemaVaults Auth API