Step 1 of the 2FA reset recovery flow. Specify which enrolled factor to reset. The response returns a resetId plus the credentials needed to complete an identity verification check: an access token for the embedded verification SDK and a hosted verificationLink. — The chosen factor must already be enrolled, otherwise the request is rejected with 100105 (Reset2faFactorMismatch). — Suspended accounts (lock level 5) cannot self-recover and are rejected; time-bounded locks (levels 1–4) are allowed and are cleared once the reset completes. — Limited to 5 initiate attempts per account per 24 hours (100106, Reset2faRateLimited, HTTP 429). The reset must be completed within 30 minutes. Calling again while a reset is still pending re-issues fresh verification credentials for the same resetId; a reset that has already passed verification returns 100101 (Reset2faInProgress, HTTP 409). — For passkey, an optional credentialId (the id from /user/passkey/list) aims the reset at one passkey: /complete then removes that passkey only and closes the reset in the same call. Without it every passkey is removed. An id that is not enrolled is rejected with 100105; credentialId with another factor fails validation (00002).