Delete a Member's MFA phone number.

To change a Member's phone number, you must first call this endpoint to delete the existing phone number.

Existing Member Sessions that include a phone number authentication factor will not be revoked if the phone number is deleted, and MFA will not be enforced until the Member logs in again. If you wish to enforce MFA immediately after a phone number is deleted, you can do so by prompting the Member to enter a new phone number and calling the OTP SMS send endpoint, then calling the OTP SMS Authenticate endpoint.

Our RBAC implementation offers out-of-the-box handling of authorization checks for this endpoint. If you pass in a header containing a session_token or a session_jwt for an unexpired Member Session, we will check that the Member Session has permission to perform the update.info.delete.mfa-phone action on the stytch.member Resource. If the Member Session matches the member_id passed in the request, the authorization check will also allow a Member Session that has permission to perform the update.info.delete.mfa-phone action on the stytch.self Resource.

If the Member Session does not contain a Role that satisfies the requested permission, or if the Member's Organization does not match the organization_id passed in the request, a 403 error will be thrown. Otherwise, the request will proceed as normal.

To learn more about our RBAC implementation, see our RBAC guide.