Complete a 2FA reset
Complete a 2FA reset once liveness has passed, clearing the lost factor so the customer can re-enroll.
The body is required and must carry the end user’s endUserIpAddress. For an
SMS_OTP reset, also supply the new mobile number — completing the reset
enrolls it as the customer’s number; other factors need no mobile.
This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.
Authorizations
API token authentication using format <api token id>:<api client secret>
Path Parameters
The reset handle returned by the start call.
Query Parameters
The unique identifier of the customer completing the reset.
Body
Completes a 2FA reset. The body is required and carries the IP address the end user is completing the reset from; mobile is only needed when resetting the SMS_OTP factor to a new phone number.
The IP address of the end user's device completing this reset, recorded against the reset by the SCA provider. Supply the customer's address, not your server's — it feeds the provider's risk assessment of the recovery.
"203.0.113.42"
For an SMS_OTP reset, the new mobile number to enroll as the customer completes the reset. Required for an SMS_OTP reset; ignored for TOTP / PASSKEY resets.
Response
Reset completed; no content is returned.