---
title: "POST /v1/users/me/mfa/recovery-codes — rotate recovery codes after second-factor proof."
method: POST
path: "/v1/users/me/mfa/recovery-codes"
tags: ["users"]
---

# POST /v1/users/me/mfa/recovery-codes — rotate recovery codes after second-factor proof.

`POST /v1/users/me/mfa/recovery-codes`

## Request body

- RotateRecoveryCodesRequest — Request body for rotating recovery codes (requires a valid TOTP code or recovery code).
  - `code` string, nullable
  - `recovery_code` string, nullable

## Response `200`

Recovery codes rotated

- RecoveryCodesResponse — Response containing a fresh set of recovery codes.
  - `recovery_codes` string[], required

## Other responses

- `400` — Invalid proof
- `401` — Unauthorized

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)