---
title: "Start a 2FA reset"
method: POST
path: "/user/2fa/reset/initiate"
tags: ["2FA Reset"]
---

# Start a 2FA reset

`POST /user/2fa/reset/initiate`

Step 1 of the 2FA reset recovery flow. Specify which enrolled `factor` to reset. The response returns a `resetId` plus the credentials needed to complete an identity verification check: an access token for the embedded verification SDK and a hosted `verificationLink`. — The chosen factor must already be enrolled, otherwise the request is rejected with `100105` (`Reset2faFactorMismatch`). — Suspended accounts (lock level 5) cannot self-recover and are rejected; time-bounded locks (levels 1–4) are allowed and are cleared once the reset completes. — Limited to 5 initiate attempts per account per 24 hours (`100106`, `Reset2faRateLimited`, HTTP 429). The reset must be completed within 30 minutes. Calling again while a reset is still pending re-issues fresh verification credentials for the same `resetId`; a reset that has already passed verification returns `100101` (`Reset2faInProgress`, HTTP 409).

## Request body

- object
  - `userId` string, uuid, required
  - `factor` 'sms' | 'totp' | 'passkey', required — The enrolled factor to reset.

## Response `200`

Identity verification check opened. Complete it using either the embedded verification SDK (`sumsubAccessToken`) or the hosted page (`verificationLink`), then poll `/user/2fa/reset/status`.

- object
  - `resetId` string, uuid, required — Identifier for this reset; pass to `/status` and `/complete`.
  - `sumsubAccessToken` string, required — Access token for the embedded verification SDK, bound to this verification check.
  - `verificationLink` string — Hosted identity verification page URL. May be absent in some cases; the access token alone is sufficient to complete verification.
  - `expiresAt` string, date-time, required — End of the 30-minute reset window.

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates (e.g. `100105` factor not enrolled).
- `401` — Invalid API key or HMAC signature.
- `409` — A 2FA reset is already in progress past the liveness step (`100101`, `Reset2faInProgress`).
- `429` — Daily initiate cap exceeded (`100106`, `Reset2faRateLimited`). `reason` carries `retryAfterSeconds`.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/revisions/63e57aa7df45/schema)