Reset all second factors of a user

POST /v1/users/{user_id}/authenticators:reset · permission user-credentials:write

Revokes all second factors of the user and deletes the recovery codes; the user enrolls a factor again at the next sign-in. include_passkeys defaults to true; with false passkeys (including those with role both) are kept. The steps run on a best-effort basis and can be repeated; a notification failure does not fail the call (notified). The response carries counts, never codes or secrets. Send an Idempotency-Key header to make retries safe.

Request

Parameter	In	Required	Description
`user_id`	path	yes	User id, prefixed `usr_`.

Optional body:

Field	Type	Required	Description
`include_passkeys`	boolean	no	`true` by default: passkeys are revoked too. With `false` passkeys (including role `both`) are kept.
`locale`	string	no	BCP 47 language tag of the notification, for example `tr`. Defaults to the user's or the environment's language.

Response

200 OK. The body counts what was done.

{
  "revoked_authenticators": 3,
  "recovery_codes_deleted": true,
  "notified": true
}

Errors

Every error is an application/problem+json body with a stable code.

HTTP	`code`	When
400	`malformed_request`, `unknown_field`	The body is not valid JSON or has an unknown field.
415	`unsupported_media_type`	A body was sent without `Content-Type: application/json`.
422	`validation_failed`	`locale` is not a valid BCP 47 language tag, or a field has the wrong type.
404	`not_found`	The user does not exist in this environment (or the id is malformed).
401	`unauthenticated`	The API key is missing, invalid or revoked.
403	`insufficient_permissions`	The key lacks the `user-credentials:write` permission.
429	`rate_limited`	The rate limit was exceeded; honor `Retry-After`.
503	`service_unavailable`	A dependency is temporarily unavailable; retry later.

Example

curl -X POST https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/authenticators:reset \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"include_passkeys": false, "locale": "en"}'

Personal data

This endpoint carries personal data: credentials. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.