---
title: "Poll the status of a 2FA reset"
method: POST
path: "/user/2fa/reset/status"
tags: ["2FA Reset"]
---

# Poll the status of a 2FA reset

`POST /user/2fa/reset/status`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/user/2fa/reset/status`
- Auth: API key in header `api-key` and API key in header `Authorization`

Step 2 — poll while the user completes identity verification, and again after `/complete` to confirm the new factor was enrolled. `status` tracks the reset lifecycle (`INITIATED` → `PENDING_REVIEW` → `LIVENESS_PASSED` → `COMPLETED`, or terminal `REJECTED` / `EXPIRED`). For `totp` / `passkey` resets, `enrollmentStatus` gives a finer signal for the enrollment step: `PENDING` once verification has passed but the new factor has not yet been submitted, `COMPLETED` once it has. SMS resets have no enrollment step, so `enrollmentStatus` is `null`.

## Request body

- object
  - `userId` string, uuid, required
  - `resetId` string, uuid, required

## Response `200`

Current state of the reset.

- object
  - `resetId` string, uuid, required
  - `factor` 'sms' | 'totp' | 'passkey', required
  - `status` 'INITIATED' | 'PENDING_REVIEW' | 'LIVENESS_PASSED' | 'COMPLETED' | 'REJECTED' | 'EXPIRED', required
  - `enrollmentStatus` 'PENDING' | 'COMPLETED', nullable, required: Enrolment-tail signal for `totp` / `passkey` resets; `null` for `sms` and for a `passkey` reset opened with a `credentialId`, which completes in the `/complete` call.
  - `expiresAt` string, date-time, required
  - `completedAt` string, date-time: Present once the reset reached `COMPLETED`.
  - `credentialId` string: Present for a `passkey` reset opened with a `credentialId` — the passkey the reset removes.

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.
- `404`: No 2FA reset found for the supplied `resetId` (`100100`, `Reset2faNotInitiated`).

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)