Disable

POST

/api/auth/mfa/disable

Disable MFA. Requires current password + a valid TOTP code (re-auth — a hijacked idle tab shouldn’t be able to turn off MFA silently). Hard- blocked if the user holds OWNER/ADMIN anywhere — mandatory MFA cannot be self-disabled, only changed via an admin editing the org membership/role first.

Authorizations

• HTTPBearer

Request Body ^required

object

current_password

required

string

otp_code

required

string

>= 6 characters <= 6 characters /^\d{6}$/

Responses

200

Successful Response

422

Validation Error

object

detail

Array<object>

object

loc

required

Array

msg

required

string

type

required

string