Remove MFA enrollment

POST

/oauth/mfaDelete

Last modified:2026-09-26 01:44:45

OperationId:MFADelete

Removes an authenticator app enrollment. Send an access token in the ns_access_token cookie or as Authorization: Bearer. Without ns_id, the endpoint removes the token holder's own enrollment, and any user scope can do that. To remove another user's enrollment, send that user's ns_id. This requires Super User, Reseller, Office Manager or Site Manager scope, and other scopes get 403. The call is idempotent: it returns 200 even when no enrollment matched, including when mfa_vendor or mfa_type doesn't match the stored values. The removal is published to the platform and takes effect once it is applied.

Request

Authorization

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

The removal was accepted. Also returned when nothing matched.

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

🔴500Server Error

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/oauth/mfaDelete' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "mfa_vendor": "google",
    "mfa_type": "authenticator"
}'

Response Example

200 - Success

{
    "status": "success",
    "message": "MFA disabled successfully",
    "enrolled": false,
    "apiversion": "46.0.0"
}

Modified at 2026-09-26 01:44:45

Enroll in MFA with access token

Refresh session tokens