Sign in
auth

Consume a recovery code for a credential-establishment authority.

Changed on

The pre-auth break-in-glass path. Consumes a single-use recovery code and mints a credential-establishment authority that may only ever establish a password (human-auth ADR § Recovery). It creates no session, no assurance, no reauthentication window — the holder establishes a new password with the authority and then logs in.

Rides the instance-wide admission budget; an unknown username, an absent batch, a stale epoch and a non-matching code all answer the same 401.

post/api/v1/auth/recovery/begin

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/auth/recovery/begin
  • Auth: none required

Request body

usernamestring required
codestring required

Response

A session-less credential-establishment authority, returned once.

authoritystring required

The single-use credential-establishment authority, returned once. It creates no session: establish a password with it, then log in.

expires_atstring date-time required

RFC 3339 UTC, microsecond precision.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status