---
title: "Start a 2FA reset (business)"
method: POST
path: "/business/2fa/reset/initiate"
tags: ["Business 2FA Reset"]
---

# Start a 2FA reset (business)

`POST /business/2fa/reset/initiate`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/business/2fa/reset/initiate`
- Auth: API key in header `api-key` and API key in header `Authorization`

Step 1 of the business 2FA reset recovery flow. Specify which enrolled `factor` to reset. The response returns a `resetId` plus the credentials needed to complete an identity verification check: an access token for the embedded verification SDK and a hosted `verificationLink`. — The chosen factor must already be enrolled, otherwise the request is rejected with `100105` (`Reset2faFactorMismatch`). — Suspended businesses (lock level 5) cannot self-recover and are rejected; time-bounded locks (levels 1–4) are allowed and are cleared once the reset completes. — Limited to 5 initiate attempts per business per 24 hours (`100106`, `Reset2faRateLimited`, HTTP 429). The reset must be completed within 30 minutes. Calling again while a reset is still pending re-issues fresh verification credentials for the same `resetId`; a reset that has already passed verification returns `100101` (`Reset2faInProgress`, HTTP 409). — For `passkey`, an optional `credentialId` (the `id` from `/business/passkey/list`) aims the reset at one passkey: `/complete` then removes that passkey only and closes the reset in the same call. Without it every passkey is removed. An id that is not enrolled is rejected with `100105`; `credentialId` with another factor fails validation (`00002`).

## Request body

- object
  - `businessId` string, uuid, required
  - `factor` 'sms' | 'totp' | 'passkey', required: The enrolled factor to reset.
  - `credentialId` string: Passkey resets only. The `id` of the passkey to remove, as returned by `/business/passkey/list`. When present, `/complete` removes that passkey only and closes the reset in the same call; when omitted, every passkey is removed. Must be enrolled (`100105` otherwise). A reset opened with a `credentialId` is closed only by `/complete`; registering a passkey through the regular endpoints after verification leaves it open.

## Response `200`

Identity verification check opened. Complete it using either the embedded verification SDK (`sumsubAccessToken`) or the hosted page (`verificationLink`), then poll `/business/2fa/reset/status`.

- object
  - `resetId` string, uuid, required: Identifier for this reset; pass to `/status` and `/complete`.
  - `sumsubAccessToken` string, required: Access token for the embedded verification SDK, bound to this verification check.
  - `verificationLink` string: Hosted identity verification page URL. May be absent in some cases; the access token alone is sufficient to complete verification.
  - `expiresAt` string, date-time, required: End of the 30-minute reset window.

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates (e.g. `100105` factor not enrolled).
- `401`: Invalid API key or HMAC signature.
- `409`: A 2FA reset is already in progress past the liveness step (`100101`, `Reset2faInProgress`).
- `429`: Daily initiate cap exceeded (`100106`, `Reset2faRateLimited`). `reason` carries `retryAfterSeconds`.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)