Disable a single MFA channel

Turns off ONE channel — app, email, or a legacy sms enrollment — and leaves the others in place.

The body carries a 6-digit code that must prove THE CHANNEL BEING REMOVED: for app, the current passcode from the member’s authenticator (there is no challenge step); for email, the code mailed by POST /v1/users/{id}/mfa/disable/challenge. Neither channel accepts the other’s code.

sms is accepted for CLEARING ONLY. The channel was retired: it cannot be enrolled, cannot be chosen as the preferred method, and is never offered at sign-in. An enrollment recorded before the retirement can still be removed here, which is also what unblocks DELETE /v1/users/{id}/phone. It is the ONE channel that needs no code and no body: SMS is refused at sign-in, and there is no SMS proof to demand. A member whose ONLY factor is a legacy sms enrollment cannot sign in to call this route themselves — an administrator clears it for them with DELETE /v1/users/{id}/mfa/admin/sms.

Removing the last enabled channel leaves the account with no second factor, the same end state as DELETE /v1/users/{id}/mfa, so check GET /v1/users/{id}/mfa first if that is not the intention.

On success the response has no body (204).

Failures:

• 400 — the channel name is not one this deployment serves.
• 400 IDE-0007 / IDE-0001 / IDE-0002 — app or email with the body missing or malformed.
• 400 IDE-0042 — the code is wrong (or, for app, already used).
• 400 IDE-0060 — email with no live mailed code: none was requested, it expired, or it was spent.
• 400 IDE-0061 — the mailed code was answered wrongly too many times; request a new one.
• 400 IDE-0063 — the authorization server locked authenticator verification; wait.
• 400 IDE-0045 — the MFA operation could not be completed.
• 404 — no such user.
• 503 IDE-0066 — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.

DELETE /v1/users/{id}/mfa/{mfaType}

Disable a single MFA channel

cURL

curl --request DELETE \
  --url https://identity.sandbox.lerian.net/v1/users/{id}/mfa/{mfaType} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "123456"
}
'

400

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Path Parameters

id · string · required

User ID.

Example:

"00000000-0000-0000-0000-000000000000"

mfaType · string · required

Which channel to disable: app, email, or sms (a legacy enrollment that can be cleared but never re-enrolled).

Example:

"app"

Body

application/json

Confirmation code proving the channel being removed. Required for app and email; omitted for sms.

code · string · required

Example:

"123456"

Response

204

No Content