curl --request DELETE \
--url https://{host}/v1/me/two-factor \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "two-factor",
"attributes": {
"otp": "123456",
"currentPassword": "the-one-they-typed"
}
}
}
'const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'two-factor',
attributes: {otp: '123456', currentPassword: 'the-one-they-typed'}
}
})
};
fetch('https://{host}/v1/me/two-factor', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/me/two-factor",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "DELETE",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'two-factor',
'attributes' => [
'otp' => '123456',
'currentPassword' => 'the-one-they-typed'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/me/two-factor"
payload = { "data": {
"type": "two-factor",
"attributes": {
"otp": "123456",
"currentPassword": "the-one-they-typed"
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/vnd.api+json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text){
"jsonapi": {
"version": "1.0"
},
"data": {
"type": "two-factor",
"attributes": {
"enabled": false
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}Disable two-factor
Scope: account-security:write
The password and a current code — the same two the website asks for. The recovery code works in place of the code, which is the whole point of having one: the phone is what is gone.
Wrong codes are counted the way they are at sign-in, so guessing is no easier here: five in fifteen minutes, and fifty in a day. A code also works once — presenting the same one again inside its window is refused, so a code read off somebody’s screen is not worth keeping.
This ends the account’s other sessions too, keeping the one that asked.
A wrong password or code — or a code once the limit is reached — answers 422
pointing at currentPassword or otp. Out of password tries (five in fifteen
minutes, shared with every endpoint that asks for it) answers 429 too_many_attempts.
curl --request DELETE \
--url https://{host}/v1/me/two-factor \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "two-factor",
"attributes": {
"otp": "123456",
"currentPassword": "the-one-they-typed"
}
}
}
'const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'two-factor',
attributes: {otp: '123456', currentPassword: 'the-one-they-typed'}
}
})
};
fetch('https://{host}/v1/me/two-factor', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/me/two-factor",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "DELETE",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'two-factor',
'attributes' => [
'otp' => '123456',
'currentPassword' => 'the-one-they-typed'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/me/two-factor"
payload = { "data": {
"type": "two-factor",
"attributes": {
"otp": "123456",
"currentPassword": "the-one-they-typed"
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/vnd.api+json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text){
"jsonapi": {
"version": "1.0"
},
"data": {
"type": "two-factor",
"attributes": {
"enabled": false
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}