---
title: "Open a recovery handshake"
method: POST
path: "/v1/me/recovery/handshakes"
tags: ["Disaster Recovery"]
---

# Open a recovery handshake

`POST /v1/me/recovery/handshakes`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/me/recovery/handshakes`
- Auth: HTTP bearer

```bash
curl -X POST https://api.subscriby.net/v1/me/recovery/handshakes \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"kind": "relink"}'
```

`kind` is `relink` (move the sign-in to a new account; needs the account recovery allowance) or `backup` (register a backup account; needs the Growth plan). Answers `201` with the pending handshake: `code` is the eight-character code to type into the bot, `start_link` the link that opens the bot on it (`null` when the creator cannot be reached on the connector), and the handshake expires fifteen minutes after it was minted.

## Headers

- `Idempotency-Key` string, uuid, required

## Request body

- OpenRecoveryHandshakeRequest: Which handshake to open.
  - `kind` 'relink' | 'backup', required: What a completed identity handshake is for. The same deep link and the same bot-side verification serve two purposes: replacing the creator's identity after a ban (`Relink`), and registering a second identity ahead of time so a later ban is a one-click switch (`Backup`). The kind is fixed when the handshake opens, so a link minted to register a backup can never be used to replace the primary identity.

## Response `201`

201 with the pending handshake, its code and link.

- object
  - `data` RecoveryHandshakeResource, required: An identity handshake: the code and link the creator completes from the account to detect, and, once an account has tapped, who that was in neutral terms.
    - `id` string, required: The handshake's id, the value the poll, cancel and confirm endpoints take.
    - `kind` string, required: `relink` (move the sign-in to a new account) or `backup` (register a backup account).
    - `kind_label` 'Replace my connected account' | 'Register a backup account', required: The kind in the creator's language.
    - `status` string, required: `pending` until an account taps, `completed` when one has, `expired` when the code ran out or was cancelled, `consumed` once confirmed.
    - `status_label` 'Waiting on the connector' | 'Account detected' | 'Linked' | 'Expired', required: The status in the creator's language.
    - `code` string, required: The eight-character code to type into the bot.
    - `start_link` string, nullable, required: The link that opens the bot on the code; null when the creator cannot be reached on the connector.
    - `connector` string, nullable, required: The connector the handshake runs on, by key.
    - `detected_display_name` string, nullable, required: The account that tapped, as the connector reported it; null while pending.
    - `detected_identity_id` string, nullable, required: The neutral identity id of the account that tapped, never the connector's own account identifier; null while pending.
    - `expires_at` string, required: When the code stops working, fifteen minutes after minting, ISO 8601.
    - `completed_at` string, nullable, required: When an account tapped, ISO 8601; null while pending.
    - `created_at` string, nullable, required: When the handshake was opened, ISO 8601.

## Other responses

- `400`: `IDEMPOTENCY_KEY_MISSING`: every write needs an `Idempotency-Key` header. Send a fresh UUID per distinct operation.
- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `409`: `IDEMPOTENCY_KEY_REUSED`: the key was already used in the last 24 hours with a different request body.
- `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: when the account allowance is spent (`relink`), the plan lacks the backup feature (`backup`), `kind` is neither, or the caller is not the account holder.
- `425`: `IDEMPOTENCY_REPLAY_IN_PROGRESS`: the first request with this key is still running; retry in a few seconds and the original response is replayed.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)