Error

A valid request URL is required to generate request examples

{
  "totp_enabled": true
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Customer plane

Disable two-factor

Requires a code that currently works — a TOTP code or a recovery code.

The staff equivalent asks for the password instead. A contact may not have one (a social-only account never did), and the password is the wrong proof anyway: what should be demanded to remove the second factor is the second factor.

A password reset does not clear it. Letting it would make two-factor bypassable by whoever holds the inbox, which is most of what it exists to stop. A contact who has lost both their phone and their recovery codes cannot get back in on their own.

POST

contact

two-factor

disable

Error

A valid request URL is required to generate request examples

{
  "totp_enabled": true
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Authorizations

Authorization

string

header

required

A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.

Body

application/json

code

string

required

Response

Disabled.

totp_enabled

boolean

Enable two-factor Replace the recovery codes

⌘I

Overview

Endpoints

Disable two-factor

Authorizations

Body

Response