---
title: "aid_customers_mfa_login_initiate_recovery_post"
method: POST
path: "/accounts/{aid}/customers/mfa_login_recovery"
tags: ["password"]
---

# aid_customers_mfa_login_initiate_recovery_post

`POST /accounts/{aid}/customers/mfa_login_recovery`

## Request

- Base URL: `https://api.dintero.com/v1`
- URL: `https://api.dintero.com/v1/accounts/{aid}/customers/mfa_login_recovery`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/dintero/apis/account-management-api/docs/accounts/:aid/customers/mfa_login_recovery/post.ts> (a function with typed inputs; its response is checked against the schema)

Initiate a Multi-Factor Authentication recovery login for a customer user
that has forgotten/lost their `secret`.
Specify the ident_type and the ident (email or phone_number) of the user. If
the call is successful, the user will get an email with an one time recovery
code that has to be submitted to the mfa_recovery endpoint.
When a valid one time recovery has been posted the server response with a
regular MFA challenge.
Once authenticated the password or pin can be changed by updating the
customer.
scopes:
  - write:accounts:/auth/users

## Path parameters

- `aid` string, ^[PT]{1}\d{8}$, required

## Request body

- MFAAuth
  - `ident_type` 'phone_number' | 'email', required
  - `ident` string, required: Email or phone_number, depending on the `ident_type`.
  - `audience` string, required: The unique identifier of the target API you want to access. The audience must be a grant associated with the client used when calling this resource.
  - `type` 'customer' | 'company', required: user type to login, required as users with different type can share email

## Response `200`

Recovery MFA challenge

- MultiFactorAuthenticationRecoveryChallenge
  - `links` object[], required
    - `rel` 'mfa_oob', required
    - `href` string, required
  - `binding_method` 'prompt'
  - `oob_code` string, required
  - `mfa_token` string, required
  - `challenge_type` 'oob', required: MFA challenge types - `oob` (out of band) means that the user will get an out of band message containing a `recovery_code` that will have to be submitted along with the `recovery_token` when answering the MFA recovery challenge.

## Other responses

- `400`: Bad / Invalid request
- `401`: Access forbidden, invalid JWT token was used
- `403`: Forbidden
- `500`: Unexpected Error

---

[API](https://skmtc.dev/dintero/apis/account-management-api.md) - [All operations](https://skmtc.dev/dintero/apis/account-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/dintero/apis/account-management-api/revisions/9b83a4199008?raw)