Skip to content
OTA-Pulse Docs

Disable

POST
/api/auth/mfa/disable
 
curl --request POST \
  --url https://example.com/api/auth/mfa/disable \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "current_password": "example", "otp_code": "example" }'

Disable MFA. Requires current password + a valid TOTP code (re-auth — a hijacked idle tab shouldn’t be able to turn off MFA silently). Hard- blocked if the user holds OWNER/ADMIN anywhere or is a platform superuser — mandatory MFA cannot be self-disabled, only changed via an admin editing the org membership/role first.

GC-BE-09: rate limited (per IP + per user), and the TOTP code is redeemed through totp_guard so an observed code cannot be replayed inside its ~90 s validity window.

Authorizations

Section titled “ Authorizations ”

Request Bodyrequired

Section titled “ Request Bodyrequired ”
Media type application/json
MfaDisableRequest
object
current_password
required
Current Password
string
otp_code
required
Otp Code
string
>= 6 characters <= 6 characters /^\d{6}$/
Example generated 
{
  "current_password": "example",
  "otp_code": "example"
}

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Successful Response

Media type application/json
Example generated 
example

422

Section titled “ 422 ”

Validation Error

Media type application/json
HTTPValidationError
object
detail
Detail
Array<object>
ValidationError
object
ctx
Context
object
input
Input
loc
required
Location
Array
msg
required
Message
string
type
required
Error Type
string
Example generated 
{
  "detail": [
    {
      "ctx": {},
      "input": "example",
      "loc": [
        "example"
      ],
      "msg": "example",
      "type": "example"
    }
  ]
}