@robotdan Thanks for the response.
This is not working as I expected. When I didn't provide a trustChallenge to the Two Factor Start API, I couldn't get the Change Password API to work. The message indicated that I needed to provide a trustToken, even though I was passing this into the API.
The workaround I found is that it worked when I provided a trustChallenge in the Two Factor Start API and the Change Password API.