---
title: "POST /api/session/mfa/send-email-otp"
method: POST
path: "/api/session/mfa/send-email-otp"
tags: ["/api/session"]
---

# POST /api/session/mfa/send-email-otp

`POST /api/session/mfa/send-email-otp`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/session/mfa/send-email-otp`
- Auth: API key in header `X-API-Key`

Email a one-time code as a fallback second factor (for a user who lost their authenticator but
  still has recovery codes disabled or unavailable). Requires a valid challenge token from
  `POST /api/session`; the code is single-use with a 10-minute expiry and is accepted by
  `POST /mfa/verify` like any other code.

## Request body

- object
  - `challenge_token` string, required: value must be a non-blank string.

## Response `2XX`

Successful response

- object
  - `success` unknown, required

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/session/mfa/send-email-otp/post.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)