> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Admin Disable MFA > Turns off one of ANOTHER member's channels — the route for a member locked out by a lost device, or by a legacy `sms` enrollment. `{id}` is the TARGET, not the administrator. `app`, `email` and `sms` are all accepted. `sms` is CLEARING ONLY — the channel is retired and cannot be re-enrolled — and this is the only route that can clear it for somebody else: the whole-account reset `DELETE /v1/users/{id}/mfa` refuses an administrator's token, and a member holding only a legacy `sms` enrollment cannot sign in to obtain their own. Clearing it also unblocks `DELETE /v1/users/{id}/phone`. ⚠️ This LOWERS someone else's protection without their participation, and it is the step an attacker who reaches an administrative token would take first. No confirmation code is taken, by design: an administrator holds neither the member's authenticator nor their mailbox, so there is no code they could legitimately produce. The administrative MFA resource is what authorizes this route. On success the response has no body (204). Failures: - `400` — the channel name is not one this deployment serves. - `403` — your token does not hold the administrative MFA resource. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. ## OpenAPI ````yaml /en/openapi/v3-current/AM-identity.yaml delete /v1/users/{id}/mfa/admin/{mfaType} openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: OpenAPI 3.1 surface for the Access Manager identity component. license: name: Lerian Studio General License title: Plugin Access Manager — Identity API version: v1 servers: - url: https://identity.sandbox.lerian.net security: [] tags: - description: >- M2M-only: each plugin declares its own permissions, roles and M2M contract, and the server reconciles them. name: Declarations - description: >- A tenant administrator's customers. Each partner holds what its credentials may DO (permissions, per product) and WHERE they may do it (scope, per product and dimension); an M2M application attached to one is confined to that intersection. Administrator-only: authorized on the "partners" resource, and every route resolves the owning organization from the caller's token. name: Partners paths: /v1/users/{id}/mfa/admin/{mfaType}: delete: tags: - MFA summary: Admin Disable MFA description: >- Turns off one of ANOTHER member's channels — the route for a member locked out by a lost device, or by a legacy `sms` enrollment. `{id}` is the TARGET, not the administrator. `app`, `email` and `sms` are all accepted. `sms` is CLEARING ONLY — the channel is retired and cannot be re-enrolled — and this is the only route that can clear it for somebody else: the whole-account reset `DELETE /v1/users/{id}/mfa` refuses an administrator's token, and a member holding only a legacy `sms` enrollment cannot sign in to obtain their own. Clearing it also unblocks `DELETE /v1/users/{id}/phone`. ⚠️ This LOWERS someone else's protection without their participation, and it is the step an attacker who reaches an administrative token would take first. No confirmation code is taken, by design: an administrator holds neither the member's authenticator nor their mailbox, so there is no code they could legitimately produce. The administrative MFA resource is what authorizes this route. On success the response has no body (204). Failures: - `400` — the channel name is not one this deployment serves. - `403` — your token does not hold the administrative MFA resource. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: adminDisableMFA parameters: - description: >- Target User ID — the member whose channel is being disabled, NOT the administrator. in: path name: id required: true schema: description: >- Target User ID — the member whose channel is being disabled, NOT the administrator. examples: - 00000000-0000-0000-0000-000000000000 type: string - description: >- Which channel to disable: app, email, or sms (a legacy enrollment that can be cleared but never re-enrolled). in: path name: mfaType required: true schema: description: >- Which channel to disable: app, email, or sms (a legacy enrollment that can be cleared but never re-enrolled). examples: - app type: string responses: '204': description: No Content '400': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Not Found '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Internal Server Error '503': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Service Unavailable security: - BearerAuth: [] components: schemas: HTTPError: additionalProperties: false properties: code: type: string entityType: type: string err: {} message: type: string title: type: string type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.