Step 3 — call once /user/2fa/reset/status reports LIVENESS_PASSED. The behaviour depends on the factor the reset was opened for: — totp: any existing TOTP configuration is cleared and a fresh secret and provisioning URI are returned; finish enrollment via /user/resume/setup-two-factor, which marks the reset COMPLETED. The time-bounded SCA lock is cleared in this call, so a locked user can log in with SMS before confirming the secret. — passkey: if the reset was opened with a credentialId, that passkey alone is removed (removedCredentialId echoes the id); otherwise every passkey is removed. Either way the reset is closed in this call and fresh PublicKeyCredentialCreationOptions are returned so a web client can enrol a replacement via /user/passkey/register/complete if wanted; a native app logs the user in with SMS and imports its new key through /user/passkey/import/start within 15 minutes of that login. — sms: provide the new mobile (countryCode + number); the stored number is updated and the reset is closed in this one call (no additional one-time code is required, as the identity verification check serves as proof of identity). — Completing the reset revokes the user's active SCA sessions and clears any time-bounded lock.