Disable MFA for Authorized User

The Disable MFA endpoint removes Multi-Factor Authentication settings for a specific authorized user profile associated with a business customer account. It targets the subProfile identified by the provided profileId and clears any MFA configuration, simplifying the login flow for that user. The platform verifies that the requesting party holds sufficient permissions before processing the deactivation.

Endpoint

POST /netevia/disablemfa/authtorized/{profileId}

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when an authorized user (subProfile) of a business customer no longer requires MFA for authentication — for example, when their access level has been downgraded, when a device change has made MFA impractical, or when an administrator is resetting authentication settings before re-enrolling the user. This endpoint applies exclusively to subProfiles (authorized users) on business accounts, not to primary account holders or personal customers.

Path Parameters

Response

200 OK

The response returns one of two schema variants depending on context. The base boarding response is returned for MFA operations.

BoardingResponse

{
  "profileId": 10482,
  "errors": null,
  "success": true,
  "changeLog": [
    {
      "requestType": 5,
      "changes": "MFA disabled for authorized user profile 10482"
    }
  ]
}

Example failure response:

{
  "profileId": 10482,
  "errors": "Profile not found or insufficient permissions to modify MFA settings.",
  "success": false,
  "changeLog": null
}

Error Codes

Common Mistakes

• Passing a profileId that belongs to a primary account holder or a personal customer — this endpoint is only valid for authorized user (subProfile) records on business accounts.
• Sending the request without a valid Bearer token or with an expired token (lifetime is 10 minutes); always refresh via POST /api/auth/refresh before retrying.
• Using a non-integer or string value for profileId in the path, which causes a 400 validation error.
• Expecting MFA to be automatically re-enabled after disabling — a separate enrollment flow must be triggered if MFA is required again in the future.

Related Endpoints

• POST /api/auth/v2 — Obtain a Bearer token for authentication
• POST /api/auth/refresh — Refresh an existing Bearer token
• POST /netevia/boarding/authorized — Create a new authorized user (subProfile) for a business account
• GET /netevia/profile/{profileId} — Retrieve details for a specific authorized user profile

Example

curl -X POST https://api.banking.netevia.dev/netevia/disablemfa/authtorized/10482 \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"