---
title: "Disable user MFA REST API | HitKeep"
description: "Reference for the HitKeep REST API operation Disable user MFA, including request parameters, responses, and authentication notes."
canonical: "https://hitkeep.com/api/operations/apiadminusersiddisable-2fa/"
---

# Disable user MFA REST API

POST

/api/admin/users/{id}/disable-2fa

FetchcURL

```
const url = 'http://127.0.0.1:25737/api/admin/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/disable-2fa';
const options = {method: 'POST', headers: {cookie: 'hk_token=<hk_token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```
curl --request POST \
  --url http://127.0.0.1:25737/api/admin/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/disable-2fa \
  --cookie hk_token=<hk_token>
```

-

Owner-only recovery action that clears TOTP, passkeys, pending MFA challenges, and remember-me sessions for the target user.

## Authorizations

- **[cookieAuth](https://hitkeep.com/api/#cookieauth)**

## Parameters

### Path Parameters

**id**

required

string format: uuid

## Responses

### 200

Disable user MFA response

application/json

object

**passkeys_deleted**

required

integer

**sessions_invalidated**

required

integer

**status**

required

string

**totp_disabled**

required

boolean

##### Examplegenerated

```
{
  "passkeys_deleted": 1,
  "sessions_invalidated": 1,
  "status": "example",
  "totp_disabled": true
}
```

### 403

Forbidden

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

### 404

Not found

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

[Previous Delete user](https://hitkeep.com/api/operations/apiadminusersid/)[Next Update user role](https://hitkeep.com/api/operations/apiadminusersidrole/)