Two-factor authentication is mandatory on this site and cannot be disabled
POST /api/account/2fa/disable returned 403 because isTotpMandatoryOnSite() is true. Longer API sibling of the Account Settings mandatory label.
Why this happens
Server enforces mandatory TOTP even if a client bypasses the UI gate. Password was not the issue — disable is forbidden by policy.
Diagnose and fix
1. Admin: change Two-factor authentication mode away from mandatory if disable should be allowed.
2. Staff can still Reset user 2FA / sessions for locked-out members.
3. Members: continue signing in with authenticator codes.