---
title: "Verify Recovery Code"
method: POST
path: "/auth/mfa/recovery-codes/verify"
tags: ["auth"]
---

# Verify Recovery Code

`POST /auth/mfa/recovery-codes/verify`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/auth/mfa/recovery-codes/verify`
- Auth: none declared

Sign in with a one-time recovery code instead of a security key.

## Request body

- RecoveryCodeVerify
  - `code` string, required

## Response `200`

Successful Response

- MfaStatusRead
  - `state` 'not_required' | 'verified' | 'challenge_required' | 'enrollment_required', required
  - `has_credentials` boolean, required
  - `required_by_policy` boolean, required
  - `webauthn_available` boolean, required
  - `webauthn_unavailable_reason` string, nullable
  - `recovery_codes_remaining` integer, required
  - `step_up_expires_at` string, date-time, nullable: When the current step-up verification stops satisfying checks.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)