Disable MFA
POST/auth/mfa/disable
Re-authenticates the user with password + live TOTP and disables MFA on the account. Emits auth.mfa.disable. Requires the self:mfa:manage permission.
Request
Responses
- 201
- 204
- 400
- 401
- 403
- 409
- 429
- 500
Resource created. Body follows the shared { data, meta } envelope; data is the newly-created resource.
MFA disabled.
Password or token invalid.
Missing or invalid access token.
The authenticated caller does not carry the required permission or is scoped out of this resource by the object-authorization service (e.g. an agent trying to view another agent's referrals). Grant the missing permission via a role change or scope the query to resources the caller owns.
The request conflicts with the current state of the target resource — a duplicate unique field on registration, an idempotency-key replay with a different payload, or a webhook eventId that has already been processed. error.code may be CONFLICT or IDEMPOTENCY_CONFLICT depending on the cause.
Rate limit exceeded. Global default is 120 requests/minute per IP; auth-flow, OTP, self-registration, WebAuthn, IRA lookup, and public-lead endpoints carry tighter per-endpoint limits. Retry after the delay indicated by the Retry-After header.
Response Headers
Seconds to wait before retrying.
Unhandled server error. The response carries a meta.requestId correlator you can hand to platform operations to trace the failure through structured logs and the hash-chained audit trail. Retry with the same Idempotency-Key header if the endpoint accepts idempotency.