---
title: "Recoverycodes"
method: POST
path: "/v1/totps/recovery_codes"
tags: ["Totp"]
---

# Recoverycodes

`POST /v1/totps/recovery_codes`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/totps/recovery_codes`
- Auth: HTTP basic

Retrieve the recovery codes for a TOTP instance tied to a User.

## Request body

- ApiTotpV1RecoveryCodesRequest: Request type
  - `user_id` string, required: The `user_id` of an active user the TOTP registration should be tied to. You may use an `external_id` here if one is set for the user.

## Response `200`

Successful response

- ApiTotpV1RecoveryCodesResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `user_id` string, required: The unique ID of the affected User.
  - `totps` ApiTotpV1TOTP[], required: An array containing a list of all TOTP instances (along with their recovery codes) for a given User in the Stytch API.
    - `totp_id` string, required: The unique ID for a TOTP instance.
    - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User.
    - `recovery_codes` string[], required: The recovery codes used to authenticate the user without an authenticator app.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`
- **2025-09-17** `864b9f438ac0`: 2 breaking
  - the `status_code` response's property type changed from `string` to `integer`, and format from no format to `int32` for status `200`
  - the `totps/items/verified` response's property type changed from `string` to `boolean` for status `200`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/totps/recovery_codes/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)