DELETE
/api/user/mfa/totp/{factor_id}AuthenticatedRemove a TOTP factor
Deletes one of the caller's authenticator-app factors (verified or still pending). The request must carry a current code from that very factor as proof of control. Removing the last verified factor also discards the account's recovery codes. A security alert e-mail is sent.
operationId
delete_api_user_mfa_totp_factor_idMulti-factor authenticationAuthentication & permissionsAuthenticated
Any authenticated user
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Any authenticated user
Path parameters
| Name | Type | Description |
|---|---|---|
| factor_id* | string (uuid) | MFA factor id, as returned by the enrollment endpoints and |
Request body
Required — A current 6-digit code generated by the factor being removed.
application/json
MfaRemoveTotpFactorRequest
| Property | Type | Description |
|---|---|---|
| code* | string | pattern: ^\d{6}$/u |
JSONExample
"code""string"
Responses
application/json
MfaFactorRemoved
| Property | Type | Description |
|---|---|---|
| success* | true |
JSONExample
"success"true
Example request
bashcurl
curl -X DELETE 'https://auth.schemavaults.com/api/user/mfa/totp/<factor_id>' \
-b 'refresh_token_<auth_server_app_id>=<value>' \
-H 'Content-Type: application/json' \
-d '{
"code": "string"
}'