1. Docs
  2. API Reference
  3. Remove an enrolled MFA factor

Remove an enrolled MFA factor

DELETE/v1/identity/auth/mfa/factors/{id}

Authentication

  • Bearer Token Authorization

    JWT access token

Path Parameters

Name Required Type Description
idRequiredstring

Headers

  • x-mfa-step-up-token required

Code samples

cURLJavaScriptPythonGo
curl -X DELETE "https://api.canopy.dev/v1/identity/auth/mfa/factors/value" \
  -H "x-mfa-step-up-token: value" \
  -H "Authorization: Bearer $CANOPY_TOKEN"

Responses

204 Deletes the factor row. Requires a fresh `X-Mfa-Step-Up-Token` proving the caller still controls a factor — this prevents a session-hijack from silently disenrolling the user's second factor. On 401, the body's `error.code` is `mfa.step_up_required` (header missing or invalid) or `auth.invalid_token` (caller's bearer token is invalid).
401 Invalid or expired token
403 This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)
404 Factor not found or does not belong to the caller
On this page

Related endpoints

GETList enrolled MFA factors for the caller
POSTBegin TOTP factor enrollment
POSTComplete TOTP factor enrollment
POSTBegin WebAuthn factor enrollment
POSTComplete WebAuthn factor enrollment
POSTProve a fresh factor to authorise a sensitive MFA mutation
POSTBegin a WebAuthn-backed step-up ceremony
POSTComplete a WebAuthn step-up ceremony
POSTRegenerate the identity's single-use recovery codes
GETList the identity's active 'remember this device' records
DELETERevoke every trusted device for the caller
DELETERevoke a single trusted device