Step 2 — poll while the operator completes identity verification, and again after /complete to confirm the new factor was enrolled. status tracks the reset lifecycle (INITIATED → PENDING_REVIEW → LIVENESS_PASSED → COMPLETED, or terminal REJECTED / EXPIRED). For totp resets, enrollmentStatus gives a finer signal for the enrollment step: PENDING once verification has passed but the new secret has not yet been confirmed through /business/resume/setup-two-factor, COMPLETED once it has. sms and passkey resets close on /complete and have no enrollment step, so enrollmentStatus is null.