Remove Factor - Pacifica

POST /api/v1/account/2fa/factors/remove

Removes one two-factor factor. Your other factors and your recovery keys stay. To get factor IDs, call Get two-factor status. You cannot remove the last factor. To remove it, disable two-factor authentication.

Operation Type (for Signing)

Header Field	Type	Content
`"type"`	string	`"remove_two_factor_factor"`

Request Body

Field	Type	Need	Description	Example
`”account”`	string	required	User’s wallet address	`42trU9A5…`
`“signature”`	string	required	Cryptographic signature	`5j1Vy9Uq…`
`“timestamp”`	integer	required	Current timestamp in milliseconds	`1716200000000`
`”factor_id”`	string	required	ID (UUID) of the factor to remove	`c9f0f895-fb98-4b91-a3b5-6e9e7c2f1d4a`
`”proof”`	object	required	Proof. A recovery key works. Not part of the signed payload. See Proofs
`”expiry_window”`	integer	optional	Signature expiry in milliseconds	`30000`

{
  "account": "42trU9A5...",
  "signature": "5j1Vy9Uq...",
  "timestamp": 1716200000000,
  "factor_id": "c9f0f895-fb98-4b91-a3b5-6e9e7c2f1d4a",
  "proof": {
    "type": "totp",
    "code": "123456"
  },
  "expiry_window": 30000
}

Sign this request with the account’s own key. Agent wallets cannot sign it. The account must be a main account. Pacifica checks that the factor exists and is not the last one before it checks the proof. A request that fails these checks does not use up your proof. This call also ends every enrollment in progress.

Signing

Sign factor_id as the data object. Do not sign proof. For the request above, the message to sign is:

{"data":{"factor_id":"c9f0f895-fb98-4b91-a3b5-6e9e7c2f1d4a"},"expiry_window":30000,"timestamp":1716200000000,"type":"remove_two_factor_factor"}

Response

Status 200: Factor removed

{
  "success": true,
  "data": null,
  "error": null,
  "code": null
}

Status 400: Invalid request parameters or signature
Status 401: The proof is wrong, expired, or already used
Status 403: The account is a subaccount, or it does not exist
Status 422: The factor cannot be removed. The error field says why:

`error`	Meaning
`the last factor cannot be removed. Disable two-factor instead.`	This is the account’s only factor
`unknown factor`	No factor on the account has this `factor_id`
`two-factor is not enabled`	2FA is off

Status 429: Too many proof attempts
Status 500: Internal server error
Status 503: The two-factor service is unavailable. Retry later

Code Example (Python)

import requests

payload = {
    "account": "42trU9A5...",
    "signature": "5j1Vy9Uq...",
    "timestamp": 1716200000000,
    "factor_id": "c9f0f895-fb98-4b91-a3b5-6e9e7c2f1d4a",
    "proof": {"type": "totp", "code": "123456"}
}

response = requests.post(
    "/api/v1/account/2fa/factors/remove",
    json=payload,
    headers={"Content-Type": "application/json"}
)

data = response.json()