---
title: "Poll the status of a 2FA reset"
method: POST
path: "/user/2fa/reset/status"
tags: ["2FA Reset"]
---

# Poll the status of a 2FA reset

`POST /user/2fa/reset/status`

Step 2 — poll while the user completes identity verification, and again after `/complete` to confirm the new factor was enrolled. `status` tracks the reset lifecycle (`INITIATED` → `PENDING_REVIEW` → `LIVENESS_PASSED` → `COMPLETED`, or terminal `REJECTED` / `EXPIRED`). For `totp` / `passkey` resets, `enrollmentStatus` gives a finer signal for the enrollment step: `PENDING` once verification has passed but the new factor has not yet been submitted, `COMPLETED` once it has. SMS resets have no enrollment step, so `enrollmentStatus` is `null`.

## Request body

- object
  - `userId` string, uuid, required
  - `resetId` string, uuid, required

## Response `200`

Current state of the reset.

- object
  - `resetId` string, uuid, required
  - `factor` 'sms' | 'totp' | 'passkey', required
  - `status` 'INITIATED' | 'PENDING_REVIEW' | 'LIVENESS_PASSED' | 'COMPLETED' | 'REJECTED' | 'EXPIRED', required
  - `enrollmentStatus` 'PENDING' | 'COMPLETED', nullable, required — Enrolment-tail signal for `totp` / `passkey` resets; `null` for `sms`.
  - `expiresAt` string, date-time, required
  - `completedAt` string, date-time — Present once the reset reached `COMPLETED`.

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates.
- `401` — Invalid API key or HMAC signature.
- `404` — No 2FA reset found for the supplied `resetId` (`100100`, `Reset2faNotInitiated`).

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/revisions/63e57aa7df45/schema)