---
title: "Complete a 2FA reset after liveness passes (business)"
method: POST
path: "/business/2fa/reset/complete"
tags: ["Business 2FA Reset"]
---

# Complete a 2FA reset after liveness passes (business)

`POST /business/2fa/reset/complete`

Step 3 — call once `/business/2fa/reset/status` reports `LIVENESS_PASSED`. The behaviour depends on the factor the reset was opened for: — `totp`: any existing TOTP configuration is cleared and a fresh secret and provisioning URI are returned; finish enrollment via `/business/resume/setup-two-factor`, which marks the reset `COMPLETED`. — `passkey`: any existing passkeys are removed and fresh `PublicKeyCredentialCreationOptions` are returned; finish via `/business/passkey/register/complete`. — `sms`: provide the new `mobile` (countryCode + number); the stored number is updated and the reset is closed in this one call (no additional one-time code is required, as the identity verification check serves as proof of identity). — Completing the reset revokes the business's active SCA sessions and clears any time-bounded lock.

## Request body

- object
  - `businessId` string, uuid, required
  - `resetId` string, uuid, required — The `resetId` returned by `/business/2fa/reset/initiate`.
  - `mobile` object — Required only for an `sms` reset — the new mobile number to store.
    - `countryCode` string, required
    - `number` string, required

## Response `200`

Reset advanced. The shape depends on the factor (`factor` discriminates): `totp` returns a fresh secret + provisioning URI to enroll via `/business/resume/setup-two-factor`; `passkey` returns WebAuthn creation options to enroll via `/business/passkey/register/complete`; `sms` returns `ok: true` (reset is already terminal).

- object
  - `factor` 'sms' | 'totp' | 'passkey', required
  - `ok` boolean — Present and `true` for `sms` — the reset completed in this call.
  - `secret` string — Present for `totp`. Raw TOTP secret.
  - `secretBase32Encoded` string — Present for `totp`. Base32-encoded TOTP secret for authenticator apps.
  - `totpUri` string — Present for `totp`. otpauth://totp/... URI; encode as a QR code on the client.
  - `options` object — Present for `passkey`. Standard WebAuthn `PublicKeyCredentialCreationOptions`. Base64url-encoded binary fields are passed through to the browser without modification.
    - `rp` object
      - `id` string
      - `name` string
    - `user` object
      - `id` string
      - `name` string
      - `displayName` string
    - `challenge` string
    - `pubKeyCredParams` object[]
      - `type` string
      - `alg` integer
    - `timeout` integer
    - `excludeCredentials` object[]
      - `type` string
      - `id` string
    - `attestation` string
    - `authenticatorSelection` object
      - `userVerification` string
      - `residentKey` string
      - `requireResidentKey` boolean
      - `authenticatorAttachment` string
  - `allowedOrigins` string[] — Present for `passkey`.
  - `relyingPartyId` string — Present for `passkey`.

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates: liveness not yet passed (`100102`, `Reset2faLivenessPending`), window expired (`100103`, `Reset2faExpired`), liveness rejected (`100104`, `Reset2faRejected`), no reset in progress (`100100`, `Reset2faNotInitiated`), or already completed (`100101`).
- `401` — Invalid API key or HMAC signature.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/versions/63e57aa7df45/schema)