# Reset a User's Passkeys

A user lost the device that held their passkeys: an administrator revokes them all, and the user registers a new one.

## Overview

- For `owner`, `tenantadmin` and `non_signing_admin`, on a user of their own tenant, with the rules of every change to another user's account ([Roles](https://docs.aureahub.com/docs/authentication.md)): `403` `A tenant admin cannot change another tenant admin's account`, `Only the tenant's owner can change another administrator's account`, `Cannot change the account of a user whose role holds permissions yours does not`.
- `200` `{ "revoked": 2 }` — how many active passkeys were revoked, `0` when the user had none. Each is `revoked` with `revokeReason` `Reset by an administrator`. The user's next passkey is a first one again: registered with the session alone ([A Lost Device](https://docs.aureahub.com/docs/guide-passkeys.md)).
- **Never your own passkeys**: `403` `PASSKEY_RESET_SELF` — revoke each of yours with [Revoke a Passkey](https://docs.aureahub.com/docs/passkey-revoke.md), which asks a step-up of your own, so that a stolen session cannot take your passkeys away. Nothing is revoked.
- `404` `User not found`. Written to your tenant's audit trail as `passkey.reset` (when it revoked one) [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md).
- Where your tenant's quorum holds administrators' actions, the reset of a user you may act on is held for another administrator (`202`). What can only be refused is refused at once, never held — no `202`, no request recorded —, with the same answer as without the quorum: your own passkeys (`403` `PASSKEY_RESET_SELF`), an account you may not act on (`403`, the account rules' message above) and a user who doesn't exist in your tenant (`404`). The reset of a user's second factor answers the same way ([Reset a User's Factor](https://docs.aureahub.com/docs/mfa-reset.md)).

> Note: **Your tenant's quorum** [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md) — where it holds administrators' actions (a tenant on the institutional security profile by its profile; every other tenant's records them only): this call answers `202` `{ "state": "awaiting_quorum", "requestId" }` — the **202** tab below — and nothing is done until another administrator of your tenant approves it; the answer it would have given is then read once by who asked ([Read the Answer](https://docs.aureahub.com/docs/quorum-request-result.md)). With no other administrator able to approve it, it is done at once. [Your Tenant's Quorum](https://docs.aureahub.com/docs/guide-tenant-quorum.md). Every other tenant gets the answers below, unchanged.

## Endpoint

### `DELETE /v1/admin/tenants/{tenantId}/users/{userId}/passkeys`

Authentication: bearer token required.

Revokes every active passkey of a user.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `tenantId` | string (uuid) | yes | Your tenant's id |
| `userId` | string (uuid) | yes | The user's id |

**Responses**

`200` Revoked

```json
{ "revoked": 2 }
```

`202` Awaiting quorum

```json
{
  "state": "awaiting_quorum",
  "requestId": "4e2b9c17-8a3d-4f60-b5e1-7c9d0a2f6b38"
}
```

`403` Not allowed

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "Only the tenant's owner can change another administrator's account"
}
```

`403` Your own

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "An administrator's reset does not revoke one's own passkeys: revoke each with POST /v1/auth/passkeys/{passkeyId}/revoke",
  "details": { "code": "PASSKEY_RESET_SELF" }
}
```

`404` Not found

```json
{
  "statusCode": 404,
  "error": "NotFoundError",
  "message": "User not found"
}
```

**Example request**

```bash
curl -X DELETE https://api.aureahub.com/v1/admin/tenants/$TENANT_ID/users/$USER_ID/passkeys \
  -H "Authorization: Bearer $ADMIN_TOKEN"
```

---

Web version: https://docs.aureahub.com/#passkeys-reset