Refreshes the short-lived provider SDK sessionToken for an existing legacy identity verification. Returns sessionTokenExpiresAt when the provider supplies an expiry. The token is not a URL and is not returned by list or get. Each call issues a fresh credential; responses are not cached or replayed.

A sole proprietor whose person id is also their account id can reach a verification keyed on that account. It resumes under the rules of POST /compliance/biometric-identity-verifications/{biometricIdentityVerificationId}/start: 422 with detailCode users.BiometricIdentityVerificationPrincipalRequired or users.BiometricIdentityVerificationPrincipalComplianceEntityRequired, 403 when the account's principal is now another person whose compliance entity belongs to that person, and 409 when the verification changed while resuming or an earlier attempt is still under review.