---
title: "Change or remove your recovery email. Needs your password and 2FA"
method: POST
path: "/api/account/email"
tags: ["Activity and account"]
---

# Change or remove your recovery email. Needs your password and 2FA

`POST /api/account/email`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/account/email`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Your recovery email is where password resets go, so changing it asks for your password AND, when an authenticator app is enrolled, a code from it, exactly like the dashboard (email 2FA alone asks for no code). A NEW address is not applied straight away: a single-use confirmation link is emailed to it and the change only lands when that link is clicked. Sending an empty address removes the recovery email immediately, which also disables email 2FA and signs out every session.

This is a **write**: a read-only API key is refused with 403.

## Response `200`

OK. For example:

```
{
  "status": "confirmation_sent",
  "email": "new@example.com",
  "note": "not applied yet: click the link sent to the new address to confirm"
}

Removing the address replies instead:
{
  "status": "email_removed",
  "note": "every session was revoked; email 2FA was disabled"
}
```

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)