---
title: "Complete a 2FA reset after liveness passes"
method: POST
path: "/user/2fa/reset/complete"
tags: ["2FA Reset"]
---

# Complete a 2FA reset after liveness passes

`POST /user/2fa/reset/complete`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/user/2fa/reset/complete`
- Auth: API key in header `api-key` and API key in header `Authorization`

Step 3 — call once `/user/2fa/reset/status` reports `LIVENESS_PASSED`. The behaviour depends on the factor the reset was opened for: — `totp`: any existing TOTP configuration is cleared and a fresh secret and provisioning URI are returned; finish enrollment via `/user/resume/setup-two-factor`, which marks the reset `COMPLETED`. — `passkey`: if the reset was opened with a `credentialId`, that passkey alone is removed, the reset is closed in this call and fresh `PublicKeyCredentialCreationOptions` are returned so a replacement can be enrolled via `/user/passkey/register/complete` if wanted (`removedCredentialId` echoes the id); otherwise every passkey is removed, the options are returned, and the registration via `/user/passkey/register/complete` closes the reset. — `sms`: provide the new `mobile` (countryCode + number); the stored number is updated and the reset is closed in this one call (no additional one-time code is required, as the identity verification check serves as proof of identity). — Completing the reset revokes the user's active SCA sessions and clears any time-bounded lock.

## Request body

- object
  - `userId` string, uuid, required
  - `resetId` string, uuid, required: The `resetId` returned by `/user/2fa/reset/initiate`.
  - `mobile` object: Required only for an `sms` reset — the new mobile number to store.
    - `countryCode` string, required
    - `number` string, required

## Response `200`

Reset advanced. The shape depends on the factor (`factor` discriminates): `totp` returns a fresh secret + provisioning URI to enroll via `/user/resume/setup-two-factor`; `passkey` returns WebAuthn creation options to enroll via `/user/passkey/register/complete` (plus `removedCredentialId` when the reset was opened for one credential; the reset is then already terminal); `sms` returns `ok: true` (reset is already terminal).

- object
  - `factor` 'sms' | 'totp' | 'passkey', required
  - `ok` boolean: Present and `true` for `sms` — the reset completed in this call.
  - `removedCredentialId` string: Present for a `passkey` reset opened with a `credentialId` — the passkey that was removed. The reset is terminal in this call.
  - `secret` string: Present for `totp`. Raw TOTP secret.
  - `secretBase32Encoded` string: Present for `totp`. Base32-encoded TOTP secret for authenticator apps.
  - `totpUri` string: Present for `totp`. otpauth://totp/... URI; encode as a QR code on the client.
  - `options` object: Present for `passkey`. Standard WebAuthn `PublicKeyCredentialCreationOptions`. Base64url-encoded binary fields are passed through to the browser without modification.
    - `rp` object
      - `id` string
      - `name` string
    - `user` object
      - `id` string
      - `name` string
      - `displayName` string
    - `challenge` string
    - `pubKeyCredParams` object[]
      - `type` string
      - `alg` integer
    - `timeout` integer
    - `excludeCredentials` object[]
      - `type` string
      - `id` string
    - `attestation` string
    - `authenticatorSelection` object
      - `userVerification` string
      - `residentKey` string
      - `requireResidentKey` boolean
      - `authenticatorAttachment` string
  - `allowedOrigins` string[]: Present for `passkey`.
  - `relyingPartyId` string: Present for `passkey`.

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates: liveness not yet passed (`100102`, `Reset2faLivenessPending`), window expired (`100103`, `Reset2faExpired`), liveness rejected (`100104`, `Reset2faRejected`), no reset in progress (`100100`, `Reset2faNotInitiated`), or already completed (`100101`).
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)