STstriga
2FA Reset

Start a 2FA reset

Step 1 of the 2FA reset recovery flow. Specify which enrolled factor to reset. The response returns a resetId plus the credentials needed to complete an identity verification check: an access token for the embedded verification SDK and a hosted verificationLink. — The chosen factor must already be enrolled, otherwise the request is rejected with 100105 (Reset2faFactorMismatch). — Suspended accounts (lock level 5) cannot self-recover and are rejected; time-bounded locks (levels 1–4) are allowed and are cleared once the reset completes. — Limited to 5 initiate attempts per account per 24 hours (100106, Reset2faRateLimited, HTTP 429). The reset must be completed within 30 minutes. Calling again while a reset is still pending re-issues fresh verification credentials for the same resetId; a reset that has already passed verification returns 100101 (Reset2faInProgress, HTTP 409). — For passkey, an optional credentialId (the id from /user/passkey/list) aims the reset at one passkey: /complete then removes that passkey only and closes the reset in the same call. Without it every passkey is removed. An id that is not enrolled is rejected with 100105; credentialId with another factor fails validation (00002).

post/user/2fa/reset/initiate

Request

  • Base URL
    https://www.sandbox.striga.com/api/v1
  • URL
    https://www.sandbox.striga.com/api/v1/user/2fa/reset/initiate
  • Auth
    API key in header api-key and API key in header Authorization

Request body

userIdstring uuid required
factor'sms' | 'totp' | 'passkey' required

The enrolled factor to reset.

credentialIdstring

Passkey resets only. The id of the passkey to remove, as returned by /user/passkey/list. When present, /complete removes that passkey only and closes the reset in the same call; when omitted, every passkey is removed. Must be enrolled (100105 otherwise). A reset opened with a credentialId is closed only by /complete; registering a passkey through the regular endpoints after verification leaves it open.

Response

Identity verification check opened. Complete it using either the embedded verification SDK (sumsubAccessToken) or the hosted page (verificationLink), then poll /user/2fa/reset/status.

resetIdstring uuid required

Identifier for this reset; pass to /status and /complete.

sumsubAccessTokenstring required

Access token for the embedded verification SDK, bound to this verification check.

verificationLinkstring

Hosted identity verification page URL. May be absent in some cases; the access token alone is sufficient to complete verification.

expiresAtstring date-time required

End of the 30-minute reset window.

Changes

No recorded changes to this operation across all 1 revision of this API.