---
title: "POST /api/ee/mfa/recovery-codes"
method: POST
path: "/api/ee/mfa/recovery-codes"
tags: ["/api/ee/mfa"]
---

# POST /api/ee/mfa/recovery-codes

`POST /api/ee/mfa/recovery-codes`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/ee/mfa/recovery-codes`
- Auth: API key in header `X-API-Key`

Regenerate the current user's recovery codes, invalidating the entire previous set. Re-auth is a
  fresh second factor — a TOTP code or an unused recovery code — so a stolen password alone can
  never rotate the codes. The plaintext codes are returned exactly once; only hashes are stored.

## Request body

- object
  - `code` string, required: value must be a non-blank string.

## Response `2XX`

Successful response

- object
  - `recovery_codes` string[], required

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/ee/mfa/recovery-codes/post.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)