---
title: "Regenerate the ten recovery codes. Requires a step-up proof. (Roles: user)"
method: POST
path: "/auth/2fa/recovery-codes"
tags: ["Authentication"]
---

# Regenerate the ten recovery codes. Requires a step-up proof. (Roles: user)

`POST /auth/2fa/recovery-codes`

## Request body

- TwoFactorStepUpPayload — A fresh second-factor proof for a change to the second factors themselves. Exactly one field; an empty body is answered with error_payload.code STEP_UP_REQUIRED.
  - `totp_code` string
  - `recovery_code` string
  - `webauthn_assertion` object

## Response `200`

Success

- TwoFactorRecoveryCodesResponse
  - `recovery_codes` string[]

## Other responses

- `400` — Error
- `429` — Too many failed second-factor attempts

## Changes

- **2026-09-01** `37a21589e770` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ludo/apis/ludo-ai-api/changes/auth/2fa/recovery-codes/post.md)

---

[API](https://skmtc.dev/ludo/apis/ludo-ai-api.md) · [All operations](https://skmtc.dev/ludo/apis/ludo-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ludo/ludo-ai-api/revisions/37a21589e770/schema)