Turns the second step off, and throws away the recovery codes.

DELETE

/api/v1/account/mfa/totp

Errors

401 when the password or code is wrong, 403 when a bearer token was used, 404 when two-step sign-in is not on, 429 when too many codes have been wrong.

Authorization

session

cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

Request Body

application/json

body

Body of DELETE /account/mfa/totp and POST /account/mfa/recovery-codes.

Either proves it is the owner asking: the password, or a code.

code?|

A code from the app, or a recovery code, instead of the password.

current_password?|

The current password. Omitted by an account without one, which confirms by a recent sign-in instead, or when code is given.

Length8 <= length <= 1024

Response Body

Off

curl -X DELETE 'https://example.com/api/v1/account/mfa/totp' \  -H 'Content-Type: application/json' \  -d '{}'

Empty