Two-factor authentication

Disable two-factor authentication

POST/api/2fa/disable

Disables two-factor authentication for the current user after verifying their password and authenticator code. Rejected when an administrator or team requires it.

Try it

Headers

Name	Type	Description
Authorizationrequired	string	Token returned by POST /api/auth/login, or an API key (`umami_…`) created under Settings → API keys (self-hosted only). `Bearer <token>`.

Request body

Name	Type	Description
passwordrequired	string	Password used to authenticate the account.
tokenrequired	string

Example request

{
  "password": "string",
  "token": "string"
}

Responses

200The operation completed successfully.

Name	Type	Description
anyOf	anyOf

200 example

{
  "error": {
    "code": "string",
    "lockedUntil": "2024-01-15T09:30:00Z",
    "message": "string"
  }
}

400Bad request.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

400 example

{
  "error": {
    "code": "bad-request",
    "message": "Bad request.",
    "status": 400
  }
}

401Unauthorized.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

401 example

{
  "error": {
    "code": "unauthorized",
    "message": "Unauthorized.",
    "status": 401
  }
}

403Forbidden.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

403 example

{
  "error": {
    "code": "forbidden",
    "message": "Forbidden.",
    "status": 403
  }
}

404Not found.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

404 example

{
  "error": {
    "code": "not-found",
    "message": "Not found.",
    "status": 404
  }
}

429The operation completed successfully.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

429 example

{
  "error": {
    "code": "string",
    "lockedUntil": "2024-01-15T09:30:00Z",
    "message": "string"
  }
}

503Service unavailable.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

503 example

{
  "error": {
    "code": "service-unavailable",
    "message": "Service unavailable.",
    "status": 503
  }
}

Code samples

cURL

curl -X POST 'https://api.example.com/api/2fa/disable' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "password": "string",
  "token": "string"
}'

PreviousConfirm two-factor authentication setup NextGet two-factor authentication status