If there is a need to reset a registered device over the REST API, which one of the following statements is incorrect?

The statement that is incorrect is C. PingAM's REST API is designed to support both administrative and self-service use cases. While administrators can manage any user's device profile, end users can also be granted specific privileges to manage their own registered devices via the REST API. This capability is essential for building self-service portals where users can reset, delete, or add their own MFA devices without administrator intervention. Therefore, the ability to use the REST API for this purpose is not exclusive to administrator accounts.

A. This is a correct statement and a common use case. Self-service pages leverage the REST API to allow users to manage their own profiles.

B. This is a correct statement. Resetting an out-of-sync HOTP device is a key administrative or self-service function available via the API.

D. This is a correct statement. Administrators have the necessary privileges to manage the device profiles of any user in the system.

1. Ping Identity, PingAM 7.3 Documentation, "REST API," Section: "The users endpoint." (This section details the API calls for managing user data, including device profiles, such as DELETE /json/users/{userId}/devices/{deviceId}).

2. Ping Identity, PingAM 7.3 Documentation, "Authorization," Section: "Privileges." (This section explains that privileges, such as user-profile-edit, can be assigned to roles. A role can be configured for end-users to allow them to edit their own profiles via the API).

3. Ping Identity, PingAM 7.3 Documentation, "Self-service," Section: "User self-service." (This section describes the self-service capabilities, which are powered by the underlying REST APIs accessible by authenticated users with appropriate permissions).