# Reset all second factors of a user

`POST /v1/users/{user_id}/authenticators:reset` · permission `user-credentials:write`

Revokes all second factors of the user and deletes the recovery codes; the user enrolls a factor again at the next sign-in. `include_passkeys` defaults to `true`; with `false` passkeys (including those with role `both`) are kept. The steps run on a best-effort basis and can be repeated; a notification failure does not fail the call (`notified`). The response carries counts, never codes or secrets. Send an `Idempotency-Key` header to make retries safe.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `user_id` | path | yes | User id, prefixed `usr_`. |

Optional body:

| Field | Type | Required | Description |
|---|---|---|---|
| `include_passkeys` | boolean | no | `true` by default: passkeys are revoked too. With `false` passkeys (including role `both`) are kept. |
| `locale` | string | no | BCP 47 language tag of the notification, for example `tr`. Defaults to the user's or the environment's language. |

## Response

`200 OK`. The body counts what was done.

```json
{
  "revoked_authenticators": 3,
  "recovery_codes_deleted": true,
  "notified": true
}
```

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 400 | `malformed_request`, `unknown_field` | The body is not valid JSON or has an unknown field. |
| 415 | `unsupported_media_type` | A body was sent without `Content-Type: application/json`. |
| 422 | `validation_failed` | `locale` is not a valid BCP 47 language tag, or a field has the wrong type. |
| 404 | `not_found` | The user does not exist in this environment (or the id is malformed). |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `user-credentials:write` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/authenticators:reset \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"include_passkeys": false, "locale": "en"}'
```

## Personal data

This endpoint carries personal data: credentials. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.