Disable MFA for Subuser Auth
This endpoint disables SMS-based multi-factor authentication (MFA) for a subuser (authorized user) associated with a business customer account. Once called, the specified subuser profile will no longer be required to complete SMS verification during login. This operation is scoped to subprofiles only and requires a valid Bearer token with appropriate boarding permissions.
Endpoint
POST /netevia/smsMfa/authtorized/{profileId}
Authentication
Bearer token required. Obtain via:
POST https://api.banking.netevia.dev/api/auth/v2Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.
When to use
Use this endpoint when a business customer or administrator needs to remove the SMS MFA requirement from a subuser account — for example, when a subuser loses access to their registered phone number or when MFA is being managed through an alternative mechanism. This is part of the boarding and account configuration workflow for business subprofiles. Only subprofiles (authorized users under a business account) are supported; this endpoint does not apply to primary account holders.
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| profileId | integer (int32) | Yes | The unique numeric identifier of the subuser (authorized user) profile for which MFA should be disabled. |
Response
200 OK
The response will be one of two shapes depending on context: a standard boarding response, or an extended response that also includes a financialAccountId.
BoardingResponse fields:
| Field | Type | Description |
|---|---|---|
| profileId | integer (int32) | The ID of the subuser profile that was updated. |
| errors | string or null | Error message if the operation encountered an issue; null on success. |
| success | boolean | Indicates whether the MFA disable operation completed successfully. |
| changeLog | array or null | Array of changelog entries describing changes applied during the request. |
ChangeLog entry fields:
| Field | Type | Description |
|---|---|---|
| requestType | integer (int32) | Enum value representing the type of banking request performed. |
| changes | string or null | Description of the specific change recorded in this log entry. |
OpenFinancialAccountResponse fields (extends BoardingResponse):
| Field | Type | Description |
|---|---|---|
| financialAccountId | string or null | The financial account identifier associated with the boarding action, if applicable. |
{
"profileId": 10482,
"errors": null,
"success": true,
"changeLog": [
{
"requestType": 5,
"changes": "SMS MFA disabled for subuser profile 10482"
}
]
}Error Codes
| Code | When it happens |
|---|---|
| 400 | Missing required fields or validation error — e.g., profileId is not a valid integer |
| 401 | Token missing, expired, or invalid |
| 403 | Insufficient permissions — caller does not have rights to modify MFA settings for this profile |
| 404 | Profile not found — no subuser exists with the given profileId |
| 500 | Internal server error |
Common Mistakes
- Passing a non-integer or negative value for
profileId— this field must be a valid int32 identifier obtained during subuser creation. - Attempting to use this endpoint against a primary (non-subuser) profile — this endpoint only applies to subprofiles of business customers.
- Using an expired token — tokens are valid for only 10 minutes; refresh via
POST /api/auth/refreshbefore calling this endpoint. - Omitting the
Authorizationheader entirely — all requests must include a valid Bearer token.
Related Endpoints
POST /api/auth/v2— Obtain a Bearer token for authenticationPOST /api/auth/refresh— Refresh an existing Bearer tokenPOST /netevia/smsMfa/...— Other SMS MFA management endpoints for subuser profilesGET /netevia/subprofile/{profileId}— Retrieve details for a specific subuser profile
Example
curl -X POST https://api.banking.netevia.dev/netevia/smsMfa/authtorized/10482 \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json"