Disable MFA for the customer's authentication

Disable MFA for Customer Authentication

The Disable MFA endpoint deactivates Multi-Factor Authentication for a specified customer profile. It performs an authorization check before executing the change to ensure only permitted callers can modify security settings. This is useful for updating security preferences or resolving authentication issues during the login process.

Endpoint

POST /netevia/disablemfa/{profileId}

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when an authorized administrator or partner needs to turn off MFA for a customer who is locked out or who has requested a change in their authentication security settings. It is also appropriate when troubleshooting login flows where MFA is preventing access for a verified user. Only call this endpoint after confirming the requestor has the necessary permissions for the target profile.

Path Parameters

Parameter	Type	Required	Description
profileId	integer (int32)	Yes	The unique numeric identifier of the customer profile for which MFA will be disabled.

Response

200 OK

The response returns one of two schemas depending on whether a financial account is involved.

BoardingResponse

Field	Type	Description
profileId	integer (int32)	The ID of the customer profile that was updated.
errors	string \| null	Error message if the operation encountered a problem; null on success.
success	boolean	Indicates whether the MFA disable operation was successful.
changeLog	array \| null	Array of change log entries describing what was modified.

changeLog item fields:

Field	Type	Description
requestType	integer (int32)	Numeric enum value representing the type of bank request performed.
changes	string \| null	Human-readable description of the changes applied.

OpenFinancialAccountResponse (extends BoardingResponse)

Field	Type	Description
profileId	integer (int32)	The ID of the customer profile that was updated.
errors	string \| null	Error message if the operation encountered a problem; null on success.
success	boolean	Indicates whether the MFA disable operation was successful.
changeLog	array \| null	Array of change log entries describing what was modified.
financialAccountId	string \| null	The ID of the associated financial account, if applicable.

{
  "profileId": 100234,
  "errors": null,
  "success": true,
  "changeLog": [
    {
      "requestType": 3,
      "changes": "MFA disabled for profile 100234"
    }
  ]
}

Error Codes

Code	When it happens
400	Missing required fields or validation error
401	Token missing, expired, or invalid
403	Insufficient permissions to disable MFA for the specified profile
404	Profile not found for the given profileId
500	Internal server error

Common Mistakes

Passing a non-integer or string value for profileId — the path parameter must be a valid int32.
Calling this endpoint without confirming the Bearer token has sufficient permissions for the target profile; the authorization check will reject unauthorized requests.
Assuming the operation succeeded without checking the success field in the response body — a 200 status code alone does not guarantee MFA was disabled if success is false.

Related Endpoints

POST /api/auth/v2 — Obtain a Bearer token for authentication
POST /api/auth/refresh — Refresh an expiring Bearer token
POST /netevia/boarding — Create a new customer profile during onboarding

Example

curl -X POST https://api.banking.netevia.dev/netevia/disablemfa/100234 \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"