POST/api/user/mfa/recovery-codes/regenerateAuthenticated

Regenerate my recovery codes

Replaces the caller's recovery codes with a fresh set, invalidating every previous code. The request must carry a current code from one of the caller's verified authenticator-app factors (factor_id). The response always has recovery_codes_issued: true.

operationId post_api_user_mfa_recovery_codes_regenerateMulti-factor authentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Request body

Required — The verified TOTP factor to prove control of, and a current code from it.

application/json
MfaRegenerateRecoveryCodesRequest
PropertyTypeDescription
factor_id*string (uuid)
code*string

pattern: ^\d{6}$/u

JSONExample
"factor_id""123e4567-e89b-12d3-a456-426614174000"
"code""string"

Responses

application/json
MfaVerifyEnrollmentResultOutcome of confirming a factor (or regenerating recovery codes). recovery_codes_issued tells whether recovery_codes carries freshly minted codes to display; when false the user's existing codes still apply and the array is empty.
PropertyTypeDescription
success*true
recovery_codes*string[]
recovery_codes_issued*boolean
JSONExample
"success"true
"recovery_codes"
"string"
"recovery_codes_issued"true

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/user/mfa/recovery-codes/regenerate' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "factor_id": "123e4567-e89b-12d3-a456-426614174000",
  "code": "string"
}'
POST /api/user/mfa/recovery-codes/regenerate | SchemaVaults Auth API