MFADisable MFA

Disable MFA

Requires a valid TOTP or unused backup code. Local (password) users must also send password. OIDC-only users omit password.

curl -X POST "//api/auth/mfa/disable" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN (JWT or sb_ API token)" \
  -d '{
  "code": "example_string",
  "password": "example_string"
}'
{
  "ok": true
}
POST
/api/auth/mfa/disable
POST
Bearer Token (JWT or sb_ API token)
Bearer Tokenstring
Required

Use Authorization: Bearer <token>. Personal API tokens from Profile use the sb_ prefix. You may also send the access JWT as Bearer (same value as the token cookie after login).

Use Authorization: Bearer <token>. Personal API tokens from Profile use the sb_ prefix. You may also send the access JWT as Bearer (same value as the token cookie after login).
Content-Typestring
Required

The media type of the request body

Options: application/json
codestring
Required

TOTP or unused backup code

passwordstring

Required when the user has a local password (omit for OIDC-only)

Request Preview
Response

Response will appear here after sending the request

Authentication

header
Authorizationstring
Required

Bearer token (JWT or sb_ API token). Use Authorization: Bearer \<token\>. Personal API tokens from Profile use the sb_ prefix. You may also send the access JWT as Bearer (same value as the token cookie after login).

Body

application/json
codestring
Required

TOTP or unused backup code

passwordstring

Required when the user has a local password (omit for OIDC-only)

Responses

okboolean