v1

latestOpenAPI 3.1.02026-07-26165182724.7 KB

2FA Reset

Start a 2FA reset

Step 1 of the 2FA reset recovery flow. Specify which enrolled factor to reset. The response returns a resetId plus the credentials needed to complete an identity verification check: an access token for the embedded verification SDK and a hosted verificationLink. — The chosen factor must already be enrolled, otherwise the request is rejected with 100105 (Reset2faFactorMismatch). — Suspended accounts (lock level 5) cannot self-recover and are rejected; time-bounded locks (levels 1–4) are allowed and are cleared once the reset completes. — Limited to 5 initiate attempts per account per 24 hours (100106, Reset2faRateLimited, HTTP 429). The reset must be completed within 30 minutes. Calling again while a reset is still pending re-issues fresh verification credentials for the same resetId; a reset that has already passed verification returns 100101 (Reset2faInProgress, HTTP 409).

post/user/2fa/reset/initiate

Request body

userIdstring uuid required

factor'sms' | 'totp' | 'passkey' required

The enrolled factor to reset.

Response

Identity verification check opened. Complete it using either the embedded verification SDK (sumsubAccessToken) or the hosted page (verificationLink), then poll /user/2fa/reset/status.

resetIdstring uuid required

Identifier for this reset; pass to /status and /complete.

sumsubAccessTokenstring required

Access token for the embedded verification SDK, bound to this verification check.

verificationLinkstring

Hosted identity verification page URL. May be absent in some cases; the access token alone is sufficient to complete verification.

expiresAtstring date-time required

End of the 30-minute reset window.