---
title: "Replace recovery codes"
method: PUT
path: "/v1/logins/{id}/recovery-codes"
tags: ["two_factor"]
---

# Replace recovery codes

`PUT /v1/logins/{id}/recovery-codes`

## Request

- Base URL: `https://api.pomerado.ai`
- URL: `https://api.pomerado.ai/v1/logins/{id}/recovery-codes`
- Auth: HTTP bearer

Replaces a saved login's two-factor recovery codes. Saved codes are never shown again, only counted. The codes pass through this client and its model provider, so warn the user first.

## Path parameters

- `id` string, required

## Request body

- object
  - `codes` string[], required: an array of at most 20 item(s)

## Response `200`

The login

- Login
  - `id` string, required: a saved login ID: login_ and 32 lowercase hex digits
  - `label` string, nullable, required
  - `site` object, required
    - `url` string, required
    - `name` string, required: The site as people say it
  - `username_masked` string, required
  - `identifier_type` 'username' | 'email' | 'phone' | 'account_number', required
  - `sign_in` 'password' | 'code', required
  - `saved_fields` string[], nullable, required: What it holds besides its username and password; null when not recorded
  - `two_factor` object, required
    - `authenticator` boolean, nullable, required
    - `sms_number` 'none' | 'linked', required
  - `status` 'unverified' | 'verified' | 'needs_attention', required
  - `needs_attention` union, required
    - object
      - `field` 'username' | 'email' | 'phone' | 'account_number' | 'password', required
    - object
      - `reason` 'account_locked', required: The website said the account is locked; unlock it on the website
  - `locked` boolean, required: Personal accounts: its identity is fixed after the first verified sign-in
  - `your_access` 'use' | 'edit' | 'manage', required: use: run and build with it. edit: also reveal and change it. manage: also share and delete it
  - `created_at` string, required: When it was saved, ISO 8601 UTC
  - `updated_at` string, required: When it last changed, ISO 8601 UTC
  - `verified_at` string, nullable, required: Its first verified sign-in, ISO 8601 UTC; null before one

## Other responses

- `400`: invalid_request
- `401`: unauthorized, reauthentication_required
- `403`: forbidden
- `404`: not_found
- `409`: site_login_exists, login_identity_conflict, legacy_duplicate_saved_logins, saved_login_unsettled, login_in_use, login_save_in_progress
- `413`: request_too_large
- `422`: invalid_credential
- `500`: internal_error
- `503`: acceptance_unknown, temporarily_unavailable

---

[API](https://skmtc.dev/pomerado/apis/pomerado-api.md) · [All operations](https://skmtc.dev/pomerado/apis/pomerado-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pomerado/apis/pomerado-api/revisions/48dac2a3143e?raw)