v1

latestOpenAPI 3.1.02026-07-26165182724.7 KB

Business 2FA Reset

Start a 2FA reset (business)

Step 1 of the business 2FA reset recovery flow. Specify which enrolled factor to reset. The response returns a resetId plus the credentials needed to complete an identity verification check: an access token for the embedded verification SDK and a hosted verificationLink. — The chosen factor must already be enrolled, otherwise the request is rejected with 100105 (Reset2faFactorMismatch). — Suspended businesses (lock level 5) cannot self-recover and are rejected; time-bounded locks (levels 1–4) are allowed and are cleared once the reset completes. — Limited to 5 initiate attempts per business per 24 hours (100106, Reset2faRateLimited, HTTP 429). The reset must be completed within 30 minutes. Calling again while a reset is still pending re-issues fresh verification credentials for the same resetId; a reset that has already passed verification returns 100101 (Reset2faInProgress, HTTP 409).

post/business/2fa/reset/initiate

Request body

businessIdstring uuid required

factor'sms' | 'totp' | 'passkey' required

The enrolled factor to reset.

Example request

{
  "businessId": "8b1d5f2a-3c4e-4a6b-9f0d-7e2c1a4b5d6e"
}

Response

Identity verification check opened. Complete it using either the embedded verification SDK (sumsubAccessToken) or the hosted page (verificationLink), then poll /business/2fa/reset/status.

resetIdstring uuid required

Identifier for this reset; pass to /status and /complete.

sumsubAccessTokenstring required

Access token for the embedded verification SDK, bound to this verification check.

verificationLinkstring

Hosted identity verification page URL. May be absent in some cases; the access token alone is sufficient to complete verification.

expiresAtstring date-time required

End of the 30-minute reset window.