---
title: "Start owner-key recovery with a fresh domain proof"
method: POST
path: "/api/v1/mcp-directory/servers/{id}/recover"
tags: ["mcp-directory"]
---

# Start owner-key recovery with a fresh domain proof

`POST /api/v1/mcp-directory/servers/{id}/recover`

## Request

- Base URL: `https://koskamo.com`
- URL: `https://koskamo.com/api/v1/mcp-directory/servers/{id}/recover`
- Auth: none declared

Returns a new token for the listing's current endpoint host. Verify it at /verify to receive a new owner key; earlier self-registration keys are revoked. A contact email cannot recover a key. The body is optional. Email ownership proof: send method "email" with proofEmail at one of admin, administrator, webmaster, hostmaster, postmaster (no plus-tags) on the endpoint host or a parent domain. A single-use confirm link (expires in 48 hours) is mailed there and never returned; once a person presses Confirm, call verify with method "email". Limits: 3 mails per address per day, 5 per IP per hour; starting again sends a new link and voids the old one. A confirmed email proof lapses after 365 days. Rate limit: 5 requests per hour per IP.

## Path parameters

- `id` string, required

## Request body

- object
  - `method` 'email': Send "email" with proofEmail for an email ownership proof; omit for a token to publish
  - `proofEmail` string, email: admin|administrator|webmaster|hostmaster|postmaster@<endpoint host or parent domain>

## Response `201`

Token issued, or confirm link mailed

- object
  - `registration` object, required
    - `purpose` 'register' | 'recover', required
    - `serverId` string, required
    - `token` string, required
    - `expiresAt` string, date-time, required
    - `proofs` object, required: Publish the token by either method. The well-known file must be on the endpoint's exact host; the TXT record may be on that host or a parent domain.
      - `http` object
        - `url` string, uri
        - `body` string
        - `note` string
      - `dns` object[]
        - `name` string
        - `type` 'TXT'
        - `value` string
    - `verify` object, required: The step-two request to send once the token is published (or the emailed link is confirmed)
      - `method` string
      - `url` string, uri
      - `body` object
    - `emailProof` object: Present for an email proof: where the confirm link was sent. The link's token is never returned.
      - `sentTo` string
      - `message` string
    - `nextSteps` string[], required: Plain-language steps from publishing the token to storing the owner key
    - `guide` string, uri, required

## Other responses

- `400`: Invalid method or proofEmail
- `403`: Access denied (trusted ingress required)
- `404`: No listed server has this id
- `429`: Rate limited (5 requests per hour per IP), or the ownership-email limit
- `503`: Email proof requested but mail is unavailable

---

[API](https://skmtc.dev/koskamo/apis/koskamo-agent-api.md) · [All operations](https://skmtc.dev/koskamo/apis/koskamo-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/koskamo/apis/koskamo-agent-api/revisions/c7761a377e7b?raw)