API reference / Accounts
post
/v2/accounts/mfa/disableDisable two-factor authentication
- Operation
disableMfa- Authentication
- None — public
Requires a current code. Without that, a stolen session could remove the second factor and keep the account.
Request
Body
codestringrequiredResponses
200Disabled.
mfa_enabledbooleanrequired400The request body or query failed validation.
errorobjectrequired401No key, an unknown key, a revoked key, or a key whose tenant is not active. All four return an identical body on purpose: distinguishing them would let a caller discover which partners we have.
errorobjectrequired403The key is valid but does not hold the scope this route requires.
errorobjectrequired404Not found, or not yours. A resource belonging to another tenant answers 404 rather than 403, because 403 would confirm the record exists.
errorobjectrequiredExample
curl -X POST https://api.haavisa.com/v2/accounts/mfa/disableMore in Accounts
POST/v1/tokenGET/v1/token/introspectPOST/v1/token/mfaPOST/v1/token/revokePOST/v2/accountsGET/v2/accounts/mePATCH/v2/accounts/meGET/v2/accounts/me/messaging-consentPUT/v2/accounts/me/messaging-consentPOST/v2/accounts/mfa/activatePOST/v2/accounts/mfa/enrollPOST/v2/accounts/password-resetPOST/v2/accounts/password-reset/confirmPOST/v2/accounts/sign-inPOST/v2/accounts/sign-outPOST/v2/accounts/verify-emailPOST/v2/accounts/verify-email/resend
Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.