MEmetabase
/api/ee/mfa

POST /api/ee/mfa/recovery-codes

Changed on

Regenerate the current user's recovery codes, invalidating the entire previous set. Re-auth is a fresh second factor — a TOTP code or an unused recovery code — so a stolen password alone can never rotate the codes. The plaintext codes are returned exactly once; only hashes are stored.

post/api/ee/mfa/recovery-codes

Request

  • Base URL
    (relative, and the document was published on a file host, not at the API’s origin)
  • Auth
    API key in header X-API-Key

Request body

codestring required

value must be a non-blank string.

Response

Successful response

recovery_codesstring[] required

Changes