> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Disable MFA > Turns OFF every second factor on the account at once. After this a password alone signs the member in. SELF-SERVICE ONLY: `{id}` must be the caller's own user id. An administrative role does not open this route for somebody else, and there is no administrative equivalent of it. To clear somebody else's factors, an administrator removes them one at a time with `DELETE /v1/users/{id}/mfa/admin/{mfaType}` — including a legacy `sms` enrollment, which is what unblocks `DELETE /v1/users/{id}/phone`. To remove one channel and keep the others, use `DELETE /v1/users/{id}/mfa/{mfaType}` instead — this route is the whole-account switch and does not ask which. The body carries a 6-digit `code` proving an ENABLED factor: the member's preferred method when it is enabled, otherwise their only enabled one, and the authenticator when both are enabled with no usable preference. For `app` it is the current passcode from their authenticator app; for `email`, the code mailed by `POST /v1/users/{id}/mfa/disable/challenge`. A mailed code never proves the reset for a member without the `email` channel enabled. The code is checked after the account-state refusals, so a request that was going to fail anyway never spends it. On success the response has no body (204). Failures: - `400 IDE-0007` / `IDE-0001` / `IDE-0002` — the body is missing or malformed. - `400 IDE-0041` — MFA is not enabled on the account, or only a legacy `sms` enrollment is left (clear it with `DELETE /v1/users/{id}/mfa/sms`). - `400 IDE-0042` — the code is wrong (or, for `app`, already used). - `400 IDE-0060` — no live mailed code: none was requested, it expired, or it was spent. - `400 IDE-0061` — the mailed code was answered wrongly too many times; request a new one. - `400 IDE-0063` — the authorization server locked authenticator verification; wait. - `400 IDE-0045` — the MFA operation could not be completed. - `404 IDE-0013` — `{id}` is not the token's subject. Distinct from `IDE-0057`, the 403 the self-scope guard raises on the profile routes. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. ## OpenAPI ````yaml /pt/openapi/v3-current/AM-identity.yaml delete /v1/users/{id}/mfa openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: OpenAPI 3.1 surface for the Access Manager identity component. license: name: Lerian Studio General License title: Access Manager Identity API version: v1 servers: - url: https://identity.sandbox.lerian.net security: [] tags: - description: >- M2M-only: each plugin declares its own permissions, roles and M2M contract, and the server reconciles them. name: Declarations - description: >- A tenant administrator's customers. Each partner holds what its credentials may DO (permissions, per product) and WHERE they may do it (scope, per product and dimension); an M2M application attached to one is confined to that intersection. Administrator-only: authorized on the "partners" resource, and every route resolves the owning organization from the caller's token. name: Partners paths: /v1/users/{id}/mfa: delete: tags: - MFA summary: Disable MFA description: >- Turns OFF every second factor on the account at once. After this a password alone signs the member in. SELF-SERVICE ONLY: `{id}` must be the caller's own user id. An administrative role does not open this route for somebody else, and there is no administrative equivalent of it. To clear somebody else's factors, an administrator removes them one at a time with `DELETE /v1/users/{id}/mfa/admin/{mfaType}` — including a legacy `sms` enrollment, which is what unblocks `DELETE /v1/users/{id}/phone`. To remove one channel and keep the others, use `DELETE /v1/users/{id}/mfa/{mfaType}` instead — this route is the whole-account switch and does not ask which. The body carries a 6-digit `code` proving an ENABLED factor: the member's preferred method when it is enabled, otherwise their only enabled one, and the authenticator when both are enabled with no usable preference. For `app` it is the current passcode from their authenticator app; for `email`, the code mailed by `POST /v1/users/{id}/mfa/disable/challenge`. A mailed code never proves the reset for a member without the `email` channel enabled. The code is checked after the account-state refusals, so a request that was going to fail anyway never spends it. On success the response has no body (204). Failures: - `400 IDE-0007` / `IDE-0001` / `IDE-0002` — the body is missing or malformed. - `400 IDE-0041` — MFA is not enabled on the account, or only a legacy `sms` enrollment is left (clear it with `DELETE /v1/users/{id}/mfa/sms`). - `400 IDE-0042` — the code is wrong (or, for `app`, already used). - `400 IDE-0060` — no live mailed code: none was requested, it expired, or it was spent. - `400 IDE-0061` — the mailed code was answered wrongly too many times; request a new one. - `400 IDE-0063` — the authorization server locked authenticator verification; wait. - `400 IDE-0045` — the MFA operation could not be completed. - `404 IDE-0013` — `{id}` is not the token's subject. Distinct from `IDE-0057`, the 403 the self-scope guard raises on the profile routes. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: disableMFA parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/MFADisableInput' description: Confirmation code proving the preferred method. required: true responses: '204': description: No Content '400': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Unauthorized '404': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Not Found '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Internal Server Error '503': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Service Unavailable security: - BearerAuth: [] components: schemas: MFADisableInput: additionalProperties: false properties: code: examples: - '123456' type: string required: - code type: object HTTPError: additionalProperties: false properties: code: type: string entityType: type: string err: {} message: type: string title: type: string type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.