Disable MFA

curl --request DELETE \
  --url https://identity.sandbox.lerian.net/v1/users/{id}/mfa \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "123456"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://identity.sandbox.lerian.net/v1/users/{id}/mfa"

	payload := strings.NewReader("{\n  \"code\": \"123456\"\n}")

	req, _ := http.NewRequest("DELETE", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'DELETE',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({code: '123456'})
};

fetch('https://identity.sandbox.lerian.net/v1/users/{id}/mfa', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://identity.sandbox.lerian.net/v1/users/{id}/mfa"

payload = { "code": "123456" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.delete(url, json=payload, headers=headers)

print(response.text)

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

Disable MFA

Turns OFF every second factor on the account at once. After this a password alone signs the member in.

SELF-SERVICE ONLY: {id} must be the caller’s own user id. An administrative role does not open this route for somebody else, and there is no administrative equivalent of it. To clear somebody else’s factors, an administrator removes them one at a time with DELETE /v1/users/{id}/mfa/admin/{mfaType} — including a legacy sms enrollment, which is what unblocks DELETE /v1/users/{id}/phone.

To remove one channel and keep the others, use DELETE /v1/users/{id}/mfa/{mfaType} instead — this route is the whole-account switch and does not ask which.

The body carries a 6-digit code proving an ENABLED factor: the member’s preferred method when it is enabled, otherwise their only enabled one, and the authenticator when both are enabled with no usable preference. For app it is the current passcode from their authenticator app; for email, the code mailed by POST /v1/users/{id}/mfa/disable/challenge. A mailed code never proves the reset for a member without the email channel enabled. The code is checked after the account-state refusals, so a request that was going to fail anyway never spends it.

On success the response has no body (204).

Failures:

400 IDE-0007 / IDE-0001 / IDE-0002 — the body is missing or malformed.
400 IDE-0041 — MFA is not enabled on the account, or only a legacy sms enrollment is left (clear it with DELETE /v1/users/{id}/mfa/sms).
400 IDE-0042 — the code is wrong (or, for app, already used).
400 IDE-0060 — no live mailed code: none was requested, it expired, or it was spent.
400 IDE-0061 — the mailed code was answered wrongly too many times; request a new one.
400 IDE-0063 — the authorization server locked authenticator verification; wait.
400 IDE-0045 — the MFA operation could not be completed.
404 IDE-0013 — {id} is not the token’s subject. Distinct from IDE-0057, the 403 the self-scope guard raises on the profile routes.
404 — no such user.
503 IDE-0066 — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.

DELETE

users

{id}

mfa

Disable MFA

curl --request DELETE \
  --url https://identity.sandbox.lerian.net/v1/users/{id}/mfa \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "123456"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://identity.sandbox.lerian.net/v1/users/{id}/mfa"

	payload := strings.NewReader("{\n  \"code\": \"123456\"\n}")

	req, _ := http.NewRequest("DELETE", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'DELETE',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({code: '123456'})
};

fetch('https://identity.sandbox.lerian.net/v1/users/{id}/mfa', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://identity.sandbox.lerian.net/v1/users/{id}/mfa"

payload = { "code": "123456" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.delete(url, json=payload, headers=headers)

print(response.text)

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

{
  "code": "<string>",
  "entityType": "<string>",
  "err": "<unknown>",
  "message": "<string>",
  "title": "<string>"
}

Authorizations

Authorization

string

header

required

JWT bearer token issued by the identity provider.

Path Parameters

string

required

User ID.

Example:

"00000000-0000-0000-0000-000000000000"

Body

application/json

Confirmation code proving the preferred method.

code

string

required

Example:

"123456"

Response

No Content

Overview

Authentication

Single sign-on

Authorization

User information

Login MFA

Identity overview

Groups

Applications

Partners

Users

Account MFA

Identity providers

Application providers

Permissions

Roles

Security policies

Plugin declarations

Error handling

Disable MFA

Authorizations

Path Parameters

Body

Response