60383: Illegal factor status

This error occurs when you try to perform an operation on a Verify Factor that is not in a valid state for that request. Verify Factors use unverified and verified statuses. Unverified Factors are automatically deleted and become unverifiable 1 to 24 hours after creation.

• The Factor is still unverified, and the request requires a completed enrollment flow before you can continue. Verify TOTP requires the user to prove they can generate a correct code from the seed. Verify Push enrollment also requires you to create and verify the Factor.
• The Factor expired before enrollment was completed. Unverified Factors are deleted and become unverifiable 1 to 24 hours after creation.
• For Verify TOTP, the registration check did not succeed. If the authPayload value is incorrect, the Factor remains unverified.
• For Verify Push, the device no longer has the original stored key material, such as after an app uninstall and reinstall, so the existing Factor can no longer be used as enrolled.

• Fetch the Factor and confirm its current status before retrying the operation. Only continue with flows that require an enrolled factor after the Factor is verified.
• If the Factor is unverified, complete Factor verification first. For Verify TOTP, submit the latest code in authPayload. For Verify Push, complete the client SDK verify step after creating the Factor.
• If the Factor is no longer usable because enrollment timed out, the Factor aged out, or the device state changed, create a new Factor and re-register the identity or device.
• For Verify Push, provide a re-enrollment path for users who reinstall the app or lose the device state. Delete old verified Factors you no longer need before re-enrolling when appropriate.

• Factor Resource
• Verify TOTP Quickstart
• Verify Push & Silent Device Approval Overview