diff --git a/modoboa/core/api/v1/viewsets.py b/modoboa/core/api/v1/viewsets.py
index 8ea9e2ca9..96b51f46c 100644
--- a/modoboa/core/api/v1/viewsets.py
+++ b/modoboa/core/api/v1/viewsets.py
@@ -67,8 +67,8 @@ class AccountViewSet(GetThrottleViewsetMixin, viewsets.ViewSet):
         serializer.is_valid(raise_exception=True)
         if not request.user.tfa_enabled:
             # We include it as "password" to display the error
-            return response.Response({"password": _("2FA is not enabled")},
-                                     status=400)
+            return response.Response({"error": _("2FA is not enabled")},
+                                     status=403)
         request.user.totpdevice_set.all().delete()
         request.user.staticdevice_set.all().delete()
         request.user.tfa_enabled = False
@@ -89,8 +89,8 @@ class AccountViewSet(GetThrottleViewsetMixin, viewsets.ViewSet):
         serializer.is_valid(raise_exception=True)
         device = request.user.staticdevice_set.first()
         if device is None:
-            return response.Response({"password": _("2FA is not enabled")},
-                                     status=400)
+            return response.Response({"error": _("2FA is not enabled")},
+                                     status=403)
         device.token_set.all().delete()
         for cpt in range(10):
             token = StaticToken.random_token()
diff --git a/modoboa/core/tests/test_viewsets.py b/modoboa/core/tests/test_viewsets.py
index 1f04ef026..c2c6553e2 100644
--- a/modoboa/core/tests/test_viewsets.py
+++ b/modoboa/core/tests/test_viewsets.py
@@ -19,7 +19,7 @@ class AccountViewSetTestCase(ModoAPITestCase):
         admin_factories.populate_database()
 
     @mock.patch("django_otp.plugins.otp_totp.models.TOTPDevice.verify_token")
-    def test_tfa_setup_process(self, verify_mock):
+    def test_tfa_setup_process(self, verify_mock, password_ok="password"):
         admin = models.User.objects.get(username="admin")
         self.client.force_login(admin)
 
@@ -58,18 +58,20 @@ class AccountViewSetTestCase(ModoAPITestCase):
 
         # Try to disable TFA auth
         url = reverse("api:account-tfa-disable")
-        response = self.client.post(url)
+        data = {"password": password_ok}
+        response = self.client.post(url, data, format="json")
         self.assertEqual(response.status_code, 200)
         self.assertFalse(admin.totpdevice_set.exists())
 
-    def test_tfa_reset_codes(self):
+    def test_tfa_reset_codes(self, password_ok="password"):
         admin = models.User.objects.get(username="admin")
         self.client.force_login(admin)
         url = reverse("api:account-tfa-reset-codes")
-        response = self.client.post(url)
+        data = {"password": password_ok}
+        response = self.client.post(url, data, format="json")
         self.assertEqual(response.status_code, 403)
 
         device = admin.staticdevice_set.create(name="Device")
-        response = self.client.post(url)
+        response = self.client.post(url, data, format="json")
         self.assertEqual(response.status_code, 200)
         self.assertEqual(device.token_set.count(), 10)