Keys
Make new recovery codes
Makes ten new one-time recovery codes, proved with the current code, and answers them once.
POST
/user/two-factor/recovery-codesTL;DR
| Question | Answer |
|---|---|
| What does it do? | Make new recovery codes. |
| What does it take? | A JSON body of type TotpCodeBody. |
| What does it return? | Status 200 with a body of type RecoveryCodes. |
| What can go wrong? | 400 the body is not valid; 401 not signed in, or the code is wrong (auth.two_factor_invalid); 403 the request came from an origin that may not make changes; 409 two-step sign-in is not on (account.two_factor_off); 429 too many requests. Every failure uses the one error envelope. |
What it does
Makes ten new one-time recovery codes, proved with the current code, and answers them once. The old ones stop working.
Request body
The body has the type TotpCodeBody.
| Field | Type | Required | Description |
|---|---|---|---|
code | string | yes | The six digits the authenticator app shows now. pattern ^\d{6}$. |
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | The new codes. | RecoveryCodes |
| 400 | The body is not valid. | ErrorResponse |
| 401 | Not signed in, or the code is wrong (auth.two_factor_invalid). | ErrorResponse |
| 403 | The request came from an origin that may not make changes. | ErrorResponse |
| 409 | Two-step sign-in is not on (account.two_factor_off). | ErrorResponse |
| 429 | Too many requests. | ErrorResponse |
Response body
A 200 answer has the type RecoveryCodes.
| Field | Type | Required | Description |
|---|---|---|---|
recoveryCodes | string[] | yes |
See also
| Doc | Why |
|---|---|
| API reference | Every endpoint, and the error envelope |
| Schemas | Every request and response type |
| Tool reference | The operations as callable tools |