Complete a 2FA reset

Complete a 2FA reset once liveness has passed, clearing the lost factor so the customer can re-enroll.

The body is required and must carry the end user’s endUserIpAddress. For an SMS_OTP reset, also supply the new mobile number — completing the reset enrolls it as the customer’s number; other factors need no mobile.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

POST /sca/factors/reset/{resetId}/complete

Complete a 2FA reset

cURL

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/sca/factors/reset/{resetId}/complete \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "endUserIpAddress": "203.0.113.42"
}
'

400

{
  "code": "INVALID_INPUT",
  "reason": "<string>",
  "details": {
    "errors": [
      {
        "field": "identifier",
        "constraint": {
          "format": "email",
          "pattern": "^\\d{5}(-\\d{4})?$",
          "enum": [
            "SSN",
            "ITIN",
            "NON_US_TAX_ID"
          ],
          "minLength": 1,
          "maxLength": 500
        },
        "message": "Value is not one of the allowed enum members."
      }
    ],
    "missingRequirements": [
      "SUPPORTING_PROOF"
    ],
    "refusalReason": "AGENT_POLICY_DENIED",
    "missingFields": [
      "PHONE_NUMBER"
    ]
  }
}

Authorizations

Authorization · string · header · required

API token authentication using format <api token id>:<api client secret>

Path Parameters

resetId · string · required

The reset handle returned by the start call.

Query Parameters

customerId · string · required

The unique identifier of the customer completing the reset.

Body

application/json

Completes a 2FA reset. The body is required and carries the IP address the end user is completing the reset from; mobile is only needed when resetting the SMS_OTP factor to a new phone number.

endUserIpAddress · string · required

The IP address of the end user's device completing this reset, recorded against the reset by the SCA provider. Supply the customer's address, not your server's — it feeds the provider's risk assessment of the recovery.

Example:

"203.0.113.42"

mobile · object

For an SMS_OTP reset, the new mobile number to enroll as the customer completes the reset. Required for an SMS_OTP reset; ignored for TOTP / PASSKEY resets.

Show child attributes

Response

204

Reset completed; no content is returned.