---
title: "Regenerate Recovery Codes"
method: POST
path: "/v1/auth/mfa/recovery-codes/regenerate"
tags: ["Auth: MFA"]
---

# Regenerate Recovery Codes

`POST /v1/auth/mfa/recovery-codes/regenerate`

## Request

- Base URL: `https://api.robosystems.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.robosystems.ai/v1/auth/mfa/recovery-codes/regenerate`
- Auth: none declared

Replace the recovery-code set after re-authentication; codes are shown once.

## Request body

- RecoveryCodesRequest: Re-authentication proof for regenerating recovery codes.
  - `password` string, nullable: Current password (password-holding users)
  - `assertion` object, nullable: Fresh WebAuthn assertion from the re-auth ceremony

## Response `200`

Successful Response

- RecoveryCodesResponse: A fresh recovery-code set — shown exactly once.
  - `codes` string[], required: Single-use recovery codes

## Other responses

- `400`: Invalid request
- `401`: Re-authentication failed
- `422`: Validation Error
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/robosystems/apis/robosystems-api.md) · [All operations](https://skmtc.dev/robosystems/apis/robosystems-api/llms.txt) · [OpenAPI document](https://skmtc.dev/robosystems/apis/robosystems-api/revisions/e661e2d5ca6a?raw)