Reset User MFA

POST /api/users/:id/mfa/reset

An organization admin (or global admin) can force-reset another user's two-step verification. This deletes the user's stored second factor and turns twoFactorEnabled off for their account — it does not enroll a new factor. The user is emailed a notification and must set up two-step verification again the next time it is required.

You cannot reset your own second factor through this endpoint. Removing your own factor goes through account security settings instead, and requires your password.

API tokens cannot call this endpoint. It requires a real, logged-in user session (an organization admin or global admin) — an Authorization: Bearer API token is always rejected, even an organization-scoped one with admin-level access. This applies to agent access tokens too. A leaked token must never be able to strip an organization's MFA protection by resetting members' factors one by one.

Request Body

None.

Example (cURL)

Call this endpoint from an authenticated browser session (the admin's own login session cookie), not with an API token:

BASE_URL="https://uptimeify.io"

curl -X POST "$BASE_URL/api/users/user_123/mfa/reset" \
  -H "Cookie: better-auth.session_token=<your-session-cookie>" \
  -H "Accept: application/json"

Response

{ "ok": true }

Common errors

• 401 unauthorized when you are not authenticated
• 403 nonUserSessionForbidden when called with an API token or agent access token instead of a real user session — see above
• 403 customerScopedTokenForbidden when called with a customer-scoped API token; this is an organization-wide action and requires an organization-scoped token or a session
• 404 userNotFound when the target :id does not resolve to a user
• 403 insufficientPermissions when the caller may not reset this user's second factor — see below

Permission rules (data.code: insufficientPermissions):

• You can never reset your own second factor through this endpoint.
• Global admins can reset any user.
• Global supporters (read-only across all organizations) can never reset a user.
• Organization admins can reset users in their own organization only; the target must belong to the same organization as the caller.
• Regular (non-admin) users can never reset another user's second factor.