Remove the authenticator app
const url = 'https://api.aetherpush.com/v1/mfa/totp';const options = { method: 'DELETE', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"stepUp":{"type":"passkey","response":{},"code":"example"}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request DELETE \ --url https://api.aetherpush.com/v1/mfa/totp \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "stepUp": { "type": "passkey", "response": {}, "code": "example" } }'Session-only. Removes the authenticator. When no passkeys remain either, MFA turns off, recovery codes are discarded, and pending MFA logins are invalidated. When MFA is enabled, a fresh step-up proof of an existing factor is required.
Authorizations
Section titled “Authorizations”Request Body
Section titled “Request Body”object
Fresh proof of a second factor the account already holds, required to change the factor set once MFA is enabled. A stolen session cannot enrol its own factor and then strip the owner’s. Recovery codes and passwords are deliberately not accepted here: a recovery code recovers a login but never authorizes a factor change.
object
WebAuthn AuthenticationResponseJSON. Required when type is passkey.
object
A current authenticator code. Required when type is totp.
Responses
Section titled “Responses”Authenticator removed.
object
False when no passkeys remain either; MFA is then disabled and the remaining recovery codes are discarded.
Examplegenerated
{ "message": "example", "mfaEnabled": true}Authentication required, or step-up is required and not satisfied (code: step_up_required).
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Returned when a factor-set change on an MFA-enabled account arrives
without a fresh step-up proof. Same shape as the reauth response so
clients branch on code and open the step-up flow, not on message text.
object
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}API keys and named access keys cannot manage MFA; a login session is required.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}No authenticator is set up.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}