DELETE/api/user/mfa/webauthn/{factor_id}Authenticated

Remove a passkey

Deletes one of the caller's passkeys. The request must carry a step-up proof of a current factor (any TOTP code, a fresh passkey assertion, or a recovery code); a passkey assertion consumes the step-up challenge whatever the outcome. Removing the last verified factor also discards the account's recovery codes. A security alert e-mail is sent.

operationId delete_api_user_mfa_webauthn_factor_idMulti-factor authentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Path parameters

NameTypeDescription
factor_id*string (uuid)

MFA factor id, as returned by the enrollment endpoints and GET /api/user/mfa/status

Request body

Required

application/json
MfaRemovePasskeyRequest
PropertyTypeDescription
proof*object | object | object

Step-up proof: a current TOTP code (type: totp), a passkey assertion for the challenge issued by POST /api/user/mfa/webauthn/authenticate-options (type: webauthn), or an unused recovery code (type: recovery_code).

JSONExample
"proof"
"type""totp"
"factor_id""123e4567-e89b-12d3-a456-426614174000"
"code""string"

Responses

application/json
MfaFactorRemoved
PropertyTypeDescription
success*true
JSONExample
"success"true

Example request

bashcurl
curl -X DELETE 'https://auth.schemavaults.com/api/user/mfa/webauthn/<factor_id>' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "proof": {
    "type": "totp",
    "factor_id": "123e4567-e89b-12d3-a456-426614174000",
    "code": "string"
  }
}'
DELETE /api/user/mfa/webauthn/{factor_id} | SchemaVaults Auth API