Skip to content

Generate recovery codes

POST
/api/v1/account/recovery
curl --request POST \
--url http://127.0.0.1:8080/api/v1/account/recovery \
--header 'Authorization: Bearer <token>' \
--header 'X-CSRF-Token: example'

Replaces any existing set and shows ten codes exactly once. Requires recent authentication. Browser session authentication and CSRF apply to protected mutations. Recent authentication means a session created within five minutes. WebAuthn challenges are one-use, browser-bound and expire after five minutes. Public sign-in requires the configured Origin header. Responses must not be cached.

X-CSRF-Token
required
string

Completed.

Media typeapplication/json
object
codes
required

Shown once; only their hashes are stored

Array<string> | null
key
additional properties
any
Examplegenerated
{
"codes": [
"example"
]
}

No valid session or API token (authentication-required), or the credential sent is invalid (invalid-credentials).

Media typeapplication/problem+json
object
code
required
string
detail
required
string
status
required
integer format: int64
title
required
string
type
required
string
key
additional properties
any
Examplegenerated
{
"code": "example",
"detail": "example",
"status": 1,
"title": "example",
"type": "example"
}

Authentication, policy, rate, or protocol validation failure.

Media typeapplication/problem+json
object
code
required
string
detail
required
string
status
required
integer format: int64
title
required
string
type
required
string
key
additional properties
any
Examplegenerated
{
"code": "example",
"detail": "example",
"status": 1,
"title": "example",
"type": "example"
}