Administration

Reset a user's two-factor authentication

DELETE/api/admin/users/{userId}/2fa

Removes the specified user's authenticator setup, backup codes, used-code history, and failed-attempt limits so they can set up authentication again.

Try it

Name	Type	Description
Authorizationrequired	string	Token returned by POST /api/auth/login, or an API key (`umami_…`) created under Settings → API keys (self-hosted only). `Bearer <token>`.

Name	Type	Description
userIdrequired	string	ID of the associated user.

200The operation completed successfully.

Name	Type	Description
okrequired	boolean	Whether the operation succeeded.
resetrequired	object

userIdrequired	string	ID of the associated user.

200 example

{
  "ok": true,
  "reset": {
    "backupCodes": {},
    "otpUsed": {},
    "rateLimit": {},
    "twoFactorAuth": {}
  },
  "userId": "string"
}

401Unauthorized.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

401 example

{
  "error": {
    "code": "unauthorized",
    "message": "Unauthorized.",
    "status": 401
  }
}

404Not found.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

404 example

{
  "error": {
    "code": "not-found",
    "message": "Not found.",
    "status": 404
  }
}

cURL

curl -X DELETE 'https://api.example.com/api/admin/users/{userId}/2fa' \
  -H 'Authorization: Bearer <token>'