Remove the second factor

DELETE

/security/mfa

A downgrade of the account, so it asks for both factors it guards: the
password, and a fresh code — a six-digit code from the authenticator
app, or a recovery code — which is spent. Without a code the answer is
401 with mfaRequired: true, so a client knows to ask for one. Wrong
passwords and wrong codes both count against the step-up lockout. An
enrolment never confirmed needs only the password. The owner's
databases' policies hear owner.mfa-removed.

Request

Body Params application/jsonRequired

Examples

Responses

🟢204

Removed

This response does not have a body.

🟠401

🟠403

🟠429

🟠400ValidationError

Request Example

Shell

JavaScript

Java

Swift

curl --location --request DELETE 'https://api.prod-orm.io/security/mfa' \
--header 'Content-Type: application/json' \
--data '{
    "current-password": "pa$$word",
    "code": "string"
}'

Response Example

401 - Example 1

{
    "error": "string",
    "mfaRequired": true
}

Modified at 2026-10-05 04:04:32

Prove the app has it

Ask for a reset link