v5

OpenAPI 3.1.0Proprietary2026-08-011476181.4 MB

Strong Customer Authentication

Start a 2FA reset

Begin recovering a lost enrolled factor via a liveness-gated, poll-based flow. Opens the liveness check and returns a resetId plus the opaque liveness handles (livenessAccessToken / verificationLink) the end user completes it with. Poll GET /sca/factors/reset/{resetId} until liveness passes, then call the complete endpoint.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

post/sca/factors/reset

Request body

factor'SMS_OTP' | 'TOTP' | 'PASSKEY' required

A Strong Customer Authentication factor.

Factor	Description
SMS_OTP	One-time code sent by SMS to the customer's verified phone. Requires no prior enrollment.
TOTP	Time-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking).
PASSKEY	WebAuthn passkey assertion. Requires enrollment.

Response

Reset initiated; the reset handle and liveness material are returned.

resetIdstring required

Identifier for this reset; pass it to the status and complete endpoints.

livenessAccessTokenstring nullable

Access token for the embedded liveness/verification SDK, bound to this reset. Omitted when one is not returned.

verificationLinkstring nullable

Hosted identity-verification page URL for completing liveness. Omitted when one is not returned.

expiresAtstring date-time nullable

Absolute UTC timestamp at the end of the reset window. Omitted when one is not returned.

Example response

{
  "expiresAt": "2025-10-03T12:30:00Z"
}