# Reset a User's Second Factor

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

A user lost their phone and their recovery codes: an administrator removes their authenticator app, and they enrol a new one.

## Overview

- For `owner`, `tenantadmin` and `non_signing_admin`, on **another** user of their own tenant, with the rules of every change to another user's account ([Roles](https://docs.aureahub.com/docs/authentication.md)): `403` `A tenant admin cannot change another tenant admin's account`, `Only the tenant's owner can change another administrator's account`, `Cannot change the account of a user whose role holds permissions yours does not`.
- **Never your own factor** while second factors are in use for your account (`log` or `enforce`, [Two-Factor Sign-In](https://docs.aureahub.com/docs/guide-two-factor.md)): `403` `MFA_RESET_SELF`. Your own app is replaced by enrolling a new one, or removed with a current code ([Remove the App](https://docs.aureahub.com/docs/mfa-totp-remove.md)); a lost phone of yours is reset by another administrator.
- `200` `{ "removed": true }` — or `false` when the user had no factor. Their app and recovery codes are gone; they enrol again.
- `202` `{ "state": "awaiting_quorum", "requestId" }` where your tenant's quorum holds administrators' actions: nothing was done until another administrator approves it ([Your Tenant's Quorum](https://docs.aureahub.com/docs/guide-tenant-quorum.md)). A reset that can only be refused — your own factor, an account you may not act on, a user who doesn't exist — is answered at once with its `403` or `404`, never held.
- `404` `User not found`. Written to the audit trail as `mfa.reset`.

## Endpoint

### `DELETE /v1/admin/tenants/{tenantId}/users/{userId}/mfa`

Authentication: bearer token required.

Removes a user's authenticator app and recovery codes.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `tenantId` | string (uuid) | yes | Your tenant's id |
| `userId` | string (uuid) | yes | The user's id |

**Responses**

`200` Removed

```json
{ "removed": true }
```

`202` Awaiting quorum

```json
{
  "state": "awaiting_quorum",
  "requestId": "4e2b9c17-8a3d-4f60-b5e1-7c9d0a2f6b38"
}
```

`403` Not allowed

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "Only the tenant's owner can change another administrator's account"
}
```

`403` Your own factor

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "An administrator's reset does not remove one's own second factor: use DELETE /v1/auth/mfa/totp with a current code",
  "details": { "code": "MFA_RESET_SELF" }
}
```

**Example request**

```bash
curl -X DELETE https://api.aureahub.com/v1/admin/tenants/$TENANT_ID/users/$USER_ID/mfa \
  -H "Authorization: Bearer $ADMIN_TOKEN"
```

---

Web version: https://docs.aureahub.com/#mfa-reset