Activity and account

Change or remove your recovery email. Needs your password and 2FA

Your recovery email is where password resets go, so changing it asks for your password AND, when an authenticator app is enrolled, a code from it, exactly like the dashboard (email 2FA alone asks for no code). A NEW address is not applied straight away: a single-use confirmation link is emailed to it and the change only lands when that link is clicked. Sending an empty address removes the recovery email immediately, which also disables email 2FA and signs out every session.

This is a write: a read-only API key is refused with 403.

post/api/account/email

Request

  • Base URL: https://eyalsec.com
  • URL: https://eyalsec.com/api/account/email
  • Auth: one of:
    • API key in header X-API-Key
    • API key in cookie __Host-es2session

Response

OK. For example:

{
  "status": "confirmation_sent",
  "email": "new@example.com",
  "note": "not applied yet: click the link sent to the new address to confirm"
}

Removing the address replies instead:
{
  "status": "email_removed",
  "note": "every session was revoked; email 2FA was disabled"
}
object required

Changes

No recorded changes to this operation across all 1 revision of this API.