Keys

Turn off two-step sign-in

Turns two-step sign-in off, proved with the current code or a recovery code.

POST/user/two-factor/disable

TL;DR

Question	Answer
What does it do?	Turn off two-step sign-in.
What does it take?	A JSON body of type `SecondFactorBody`.
What does it return?	Status 200 with a body of type `Accepted`.
What can go wrong?	`400` the body is not valid; `401` not signed in, or the code is wrong (`auth.two_factor_invalid`); `403` the request came from an origin that may not make changes; `409` it is not on (`account.two_factor_off`), or an organisation requires it (`account.two_factor_required_by_org`); `429` too many requests. Every failure uses the one error envelope.

Turns two-step sign-in off, proved with the current code or a recovery code. Refused while an organisation you are in requires it.

The body has the type SecondFactorBody.

Field	Type	Required	Description
`code`	`string`	no	The six digits the authenticator app shows now. pattern `^\d{6}$`.
`recoveryCode`	`string`	no	One of the recovery codes made when two-step sign-in was turned on. Each works once. at least 10 characters; at most 32 characters.

Status	Meaning	Body
200	Off.	`Accepted`
400	The body is not valid.	`ErrorResponse`
401	Not signed in, or the code is wrong (`auth.two_factor_invalid`).	`ErrorResponse`
403	The request came from an origin that may not make changes.	`ErrorResponse`
409	It is not on (`account.two_factor_off`), or an organisation requires it (`account.two_factor_required_by_org`).	`ErrorResponse`
429	Too many requests.	`ErrorResponse`

A 200 answer has the type Accepted.

Field	Type	Required	Description
`accepted`	`true`	yes

Doc	Why
API reference	Every endpoint, and the error envelope
Schemas	Every request and response type
Tool reference	The operations as callable tools