Reset a customer's two-factor authentication
DELETEhttps://api.evora.lol/api/developer-api/users/{userId}/2fa
Requires scopeusers:write
Clears the customer's second factor so they can enrol again. For the support case where someone has lost both their authenticator app and their backup codes.
This is the only path that removes a second factor without presenting a code, which is why it requires your developer credentials and is not reachable from the SDK — a self-service "turn it off" would defeat the feature entirely.
The customer's live sessions across your applications are ended at the same time, on the assumption that the reason for the reset may have been a compromise.
Path parameters
| userIdrequired string (uuid) | End-user UUID. |
Responses
200Two-factor cleared and sessions ended.
json
{ "success": true }
400The customer does not have two-factor enabled.
json
{ "error": "Two-factor authentication is not enabled for this user" }
404User not found, or not yours.
json
{ "error": "User not found" }
More in Users
- getLook up a customer by username
- getList customers
- postCreate a customer
- getGet a customer
- putUpdate a customer
- deleteDelete a customer
- postMint a password-reset token
- postConsume a reset token and set the new password
- postBan a customer
- postUnban a customer
- postReset a customer's HWID
- getRead a customer's two-factor state
- postReset a customer's device binding
- postMint a one-time SDK login token (panel SSO)
- postRedeem a license key on a customer's behalf
- postBulk customer actions
Base URL https://api.evora.lol/api/developer-api · full spec at developer-api.yaml · back to the docs