Sign in

v1

latestOpenAPI 3.1.02026-07-26165182724.7 KB
2FA Reset

Complete a 2FA reset after liveness passes

Step 3 — call once /user/2fa/reset/status reports LIVENESS_PASSED. The behaviour depends on the factor the reset was opened for: — totp: any existing TOTP configuration is cleared and a fresh secret and provisioning URI are returned; finish enrollment via /user/resume/setup-two-factor, which marks the reset COMPLETED. — passkey: any existing passkeys are removed and fresh PublicKeyCredentialCreationOptions are returned; finish via /user/passkey/register/complete. — sms: provide the new mobile (countryCode + number); the stored number is updated and the reset is closed in this one call (no additional one-time code is required, as the identity verification check serves as proof of identity). — Completing the reset revokes the user's active SCA sessions and clears any time-bounded lock.

post/user/2fa/reset/complete

Request body

userIdstring uuid required
resetIdstring uuid required

The resetId returned by /user/2fa/reset/initiate.

Response

Reset advanced. The shape depends on the factor (factor discriminates): totp returns a fresh secret + provisioning URI to enroll via /user/resume/setup-two-factor; passkey returns WebAuthn creation options to enroll via /user/passkey/register/complete; sms returns ok: true (reset is already terminal).

factor'sms' | 'totp' | 'passkey' required
okboolean

Present and true for sms — the reset completed in this call.

secretstring

Present for totp. Raw TOTP secret.

secretBase32Encodedstring

Present for totp. Base32-encoded TOTP secret for authenticator apps.

totpUristring

Present for totp. otpauth://totp/... URI; encode as a QR code on the client.

allowedOriginsstring[]

Present for passkey.

relyingPartyIdstring

Present for passkey.