POST /v1/console/totp/disable


Call	`POST /v1/console/totp/disable`
Price	free
Scope	console session cookie (not an API key)
Operation id	`disableTotp`

What it does

Turn TOTP off for the signed-in user, given a current code. Refused with 403 while the user owns an organization with more than one member, where TOTP is required (spec 9.1). Audited as totp_disabled in each of the user’s organizations. Session cookie required.

Example request

Copy it as curl. Set VERDICT_API_KEY first; uuidgen makes a fresh Idempotency-Key.

curl -X POST 'https://api.askverdict.io/v1/console/totp/disable' \
  --cookie "verdict_session=$VERDICT_SESSION" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/json' \
  -d '{
  "code": "123456"
}'

Example response

200: TOTP is off.

{
  "totp_enabled": false,
  "mfa_verified": false
}

Parameters

Name	In	Type	Required	Description
`idempotency-key`	header	string (uuid)	yes	A UUID you generate per logical request. Required on every POST. Repeating it within 24 hours returns the stored response and bills nothing; reusing it with a different body returns 409 `idempotency_conflict`.

Request body

Schema TotpCodeRequest. A current code.

Field	Type	Required	Description
`code`	string	yes	The six-digit code from the authenticator app.

Response fields (200)

Schema TotpStatusResponse.

Field	Type	Required	Description
`totp_enabled`	boolean	yes	Whether TOTP is now on for the user.
`mfa_verified`	boolean	yes	Whether this session has now passed TOTP.

Errors

Errors are RFC 9457 problem details and are never billed. Branch on type. See Errors.

Status	Meaning
`400`	Invalid request: malformed JSON, an unknown field, a failed constraint or a size limit (`invalid_request`).
`401`	Missing, malformed, revoked or expired API key, or a bad webhook signature (`unauthorized`).
`403`	The key lacks the scope this operation needs (`forbidden_scope`).
`404`	The resource does not exist in this organization (`not_found`).
`429`	Rate limited (`rate_limited`). Wait `Retry-After` seconds.
`500`	Unexpected server error (`internal`). Not billed; retry with the same `Idempotency-Key`.

Try it

Open the interactive reference to send this request from the browser. The full document is at /openapi.json.