---
title: "Start a 2FA reset"
method: POST
path: "/sca/factors/reset"
tags: ["Strong Customer Authentication"]
---

# Start a 2FA reset

`POST /sca/factors/reset`

Begin recovering a lost enrolled factor via a liveness-gated, poll-based
flow. Opens the liveness check and returns a `resetId` plus the
opaque liveness handles (`livenessAccessToken` / `verificationLink`) the end
user completes it with. Poll
`GET /sca/factors/reset/{resetId}` until liveness
passes, then call the complete endpoint.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

## Request body

- TwoFactorResetStartRequest — Selects which enrolled factor to reset via the liveness-gated recovery flow.
  - `factor` 'SMS_OTP' | 'TOTP' | 'PASSKEY', required — A Strong Customer Authentication factor. | Factor | Description | |--------|-------------| | `SMS_OTP` | One-time code sent by SMS to the customer's verified phone. Requires no prior enrollment. | | `TOTP` | Time-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking). | | `PASSKEY` | WebAuthn passkey assertion. Requires enrollment. |

## Response `201`

Reset initiated; the reset handle and liveness material are returned.

- TwoFactorResetStart — The reset handle plus the opaque liveness handles a caller relays to the end-user device to complete the liveness check. `resetId` threads the ceremony together (status and complete reference it). `livenessAccessToken` and `verificationLink` are omitted when they are not returned.
  - `resetId` string, required — Identifier for this reset; pass it to the status and complete endpoints.
  - `livenessAccessToken` string, nullable — Access token for the embedded liveness/verification SDK, bound to this reset. Omitted when one is not returned.
  - `verificationLink` string, nullable — Hosted identity-verification page URL for completing liveness. Omitted when one is not returned.
  - `expiresAt` string, date-time, nullable — Absolute UTC timestamp at the end of the reset window. Omitted when one is not returned.

## Other responses

- `400` — Invalid or unknown factor
- `401` — Unauthorized
- `404` — Customer not found
- `409` — SCA is not required for this customer.
- `429` — Too many reset attempts. Reset initiation is rate-limited to 5 per 24 hours per customer; retry after the window indicated by `Retry-After`.
- `500` — Internal service error

## Changes

- **2026-08-14** `aaa1fb8782c8` — 1 warning
  - added the new `EXTERNAL_ACCOUNT_VERIFICATION_REQUIRED` enum value to the `code` response property for the response status `400`
- **2026-08-13** `df12ec487f0e` — 2 warning
  - added the new `DAILY_VOLUME_LIMIT_EXCEEDED` enum value to the `code` response property for the response status `429`
  - added the new `TRANSACTION_SIZE_LIMIT_EXCEEDED` enum value to the `code` response property for the response status `400`
- **2026-08-11** `b06902b6595a` — 4 warning
  - added the new `CARDHOLDER_KYC_NOT_APPROVED` enum value to the `code` response property for the response status `400`
  - added the new `CARD_ALREADY_CLOSED` enum value to the `code` response property for the response status `409`
  - added the new `CARD_NOT_MUTABLE` enum value to the `code` response property for the response status `409`
  - added the new `INVALID_STATE_TRANSITION` enum value to the `code` response property for the response status `409`
- **2026-08-06** `526036c12609` — 1 warning
  - added the new `END_USER_TERMS_VERSION_NOT_FOUND` enum value to the `code` response property for the response status `400`
- …earlier changes not shown

[Full history](https://skmtc.dev/stainless-api/apis/grid-api/changes/sca/factors/reset/post.md)

---

[API](https://skmtc.dev/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.dev/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/stainless-api/grid-api/revisions/2ec84c06fbec/schema)