Turns off an account's two-step sign-in, for someone who has lost both the authenticator and the recovery codes.

DELETE

/api/v1/admin/users/{id}/mfa

The account signs in with its password alone afterwards, and can set up a new authenticator from there. Nothing else about it changes.

The caller asked for the account to sign in without a code, and it does.

401 when nothing was signed in, 403 when the caller may not change accounts or used a bearer token, 404 when no account has that identifier.

Authorization

session

cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

id*string

Whose two-step sign-in to turn off

It signs in with its password alone

curl -X DELETE 'https://example.com/api/v1/admin/users/string/mfa'

Empty