Disable OTP for Subuser Operations
The Disable OTP endpoint allows administrators to remove the One-Time Password requirement for a specific subuser's operations within a business account. By targeting the subuser's profile ID, the API deactivates OTP verification so that transactions and account actions no longer require a one-time code. Authorization is verified on each request to ensure only permitted administrators can modify these security settings.
Endpoint
POST /netevia/disableotp/authtorized/{profileId}
Authentication
Bearer token required. Obtain via:
POST https://api.banking.netevia.dev/api/auth/v2Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.
When to use
Use this endpoint when an administrator needs to streamline access for a specific subuser by removing the OTP requirement from their operations. This is appropriate when a subuser's authentication workflow needs to be simplified, such as for trusted internal users or automated service accounts. Only administrators with sufficient permissions to modify subuser security settings should call this endpoint.
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| profileId | integer (int32) | Yes | The unique identifier of the subuser (authorized user) profile for which OTP will be disabled. |
Response
200 OK
| Field | Type | Description |
|---|---|---|
| profileId | integer | The ID of the subuser profile that was updated. |
| success | boolean | Indicates whether the OTP disable operation completed successfully. |
| errors | string | Error message if the operation failed; null on success. |
| changeLog | array | List of change log entries recording what was modified. |
| changeLog[].requestType | integer | Numeric code representing the type of boarding request that was processed. |
| changeLog[].changes | string | Description of what changed during the operation. |
{
"profileId": 10482,
"success": true,
"errors": null,
"changeLog": [
{
"requestType": 5,
"changes": "OTP disabled for authorized profile 10482"
}
]
}Error Codes
| Code | When it happens |
|---|---|
| 400 | Missing required fields or validation error |
| 401 | Token missing, expired, or invalid |
| 403 | Insufficient permissions to modify OTP settings for this profile |
| 404 | Profile with the specified profileId not found |
| 500 | Internal server error |
Common Mistakes
- Providing a
profileIdthat belongs to a primary business account owner rather than a subuser — this endpoint targets authorized subuser profiles only. - Using an expired Bearer token; tokens expire after 10 minutes and must be refreshed via
POST /api/auth/refreshbefore calling this endpoint. - Attempting to disable OTP without the appropriate administrator-level permissions, which results in a 403 error.
Related Endpoints
POST /netevia/enableotp/authtorized/{profileId}— Re-enables OTP authentication for a subuser's operations.POST /netevia/boarding/createSubProfile— Creates a new authorized subuser profile under a business account.POST /api/auth/v2— Obtains a Bearer token for authenticating API requests.
Example
curl -X POST https://api.banking.netevia.dev/netevia/disableotp/authtorized/10482 \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json"