Disable 2FA on the caller's account

DELETE

/account/security/2fa

• Local development behind nginx (port 8088 by default)

Requires the caller’s current password to prevent a stolen-session attacker from disabling 2FA. Cascades the recovery codes via FK.

Authorizations

• cookieAuth

Request Body ^required

Body for the disable + regenerate-recovery surfaces. Re-asks for the current password so a stolen-session attacker can’t kill 2FA + lock the owner out in one move.

object

current_password

required

string format: password

Responses

204

2FA disabled.

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}