Disable Mfa — POST /api/v1/auth/mfa/disable
Disable Mfa
Turn MFA off. Requires the password and a live second factor.
Endpoint: POST /api/v1/auth/mfa/disable
Authentication: Send a signed-in user’s access token in Authorization: Bearer <access token>. API keys are refused.
Parameters
Section titled “Parameters”| Name | In | Required | Type | Default | Description |
|---|---|---|---|---|---|
X-API-Key | header | no | string or null | API key, as an alternative to the access token (see Authentication). |
Request body
Section titled “Request body”| Content type | Body | Required |
|---|---|---|
application/json | MfaDisableRequest | yes |
Responses
Section titled “Responses”| Status | Meaning | Body |
|---|---|---|
204 | Successful Response | No body |
422 | Validation Error | HTTPValidationError (application/json) |
204 returns no body.
Errors this endpoint returns, read from its source code:
400, with messages such as “A valid authenticator code or recovery code is required to disable MFA”, “Password is incorrect”403, with the message “Workspace policy requires MFA for your role, so it cannot be disabled. Ask an administrator to change the policy or reset your device”409, with the message “MFA is not enabled for this account”
It can also return 401 if your credential is missing or expired, 403 if your credential does not allow this request, and 404 if the item does not exist or you cannot see it. Your role, your project membership and the key’s scope decide what a credential allows. See Errors and retries.
More details
Section titled “More details”- Group: Authentication
- Operation ID:
disable_mfa_api_v1_auth_mfa_disable_post - Source code:
backend/app/routers/mfa.py, line 457 - Specification: OpenAPI JSON