Replace the recovery codes
POST/admin/auth/totp/recovery-codes
Invalidates the previous set and answers with a new one. Shown once, like the first set.
The password is required on top of the session. These codes are permanent bypasses of the second factor, so a stolen cookie must not be enough to mint a fresh set of them.
Request
Responses
- 200
- 400
- 401
- 403
- 409
The new codes — shown once
Malformed body
No session cookie, or invalid_credentials
account_suspended
Two-factor is not set up, so there are no codes to replace