Remove Common Multi-Factor Secret

Remove Common Multi-Factor Secret

This endpoint removes the shared Multi-Factor Authentication (MFA) secret associated with the authenticated user's account, disabling Time-Based One-Time Password (TOTP) generation via authenticator apps such as Google Authenticator or Authy. Once removed, the user will no longer be prompted to enter OTPs from an authenticator app during login or other secure actions. Other MFA methods (such as SMS or email) remain unaffected if separately enabled.

Endpoint

DELETE /settings/MfaSecret

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when a user opts to disable their authenticator-app-based MFA from the account security settings. This is appropriate when the user is switching to a different MFA method, lost access to their authenticator app, or is resetting their MFA configuration. After a successful call the previously registered TOTP secret is invalidated and the user is no longer required to provide a TOTP code on subsequent authentications.

Response

200 OK

The MFA secret has been successfully removed. No response body is returned.

{}

Error Codes

Common Mistakes

• Calling this endpoint without a valid Bearer token will result in a 401 error; ensure the token has not expired (lifetime is 10 minutes).
• Removing the TOTP secret does not disable all MFA on the account — SMS or email-based MFA methods configured separately remain active.
• Do not call this endpoint to simply regenerate the MFA secret; use the appropriate setup endpoint to create a new TOTP secret instead.
• Passing a request body is unnecessary and will be ignored; the user is identified solely by the Bearer token.

Related Endpoints

• POST /settings/MfaSecret — Register or regenerate a TOTP-based MFA secret for the authenticated user
• GET /settings/MfaSecret — Retrieve the current MFA secret status for the authenticated user
• POST /api/auth/v2 — Obtain a Bearer token using username, password, and partnerId

Example

curl -X DELETE https://api.banking.netevia.dev/settings/MfaSecret \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"