Turns off two-factor authentication for a member who lost their authenticator app and recovery codes.
HTTP
DELETE /org/members/{userId}/mfaAccess: Session token only. API keys get 403 with insufficient_scope.
Role: Organisation owner or admin.
They sign in with their password and, if the organisation requires it, set it up again.
Path parameters #
| Parameter | Description |
|---|---|
userId | The id of the member. |
Response 204 #
It is reset. There is no body. The audit log gets an org.member_mfa_reset entry.
Errors #
| Status | error | When |
|---|---|---|
| 401 | unauthenticated | The token is missing or not valid. |
| 403 | forbidden | You are not an owner or admin, or the member is the owner and not you. |
| 404 | not_found | The user is not a member. |
| 429 | rate_limited | Too many requests, see Rate limiting. |
See Errors for the error format.