Send Access Code

Email a locked-out user a fresh single-use sign-in code (admin surface P12).

The other half of the invite: for someone who was provisioned before this existed, or whose invite mail never arrived, or who simply cannot reach the self-service reset. Without it an administrator's only option is to set a password on the user's behalf and send it over some channel — which means an admin choosing a customer's credential and transmitting it in plaintext.

This never sets a password and never reveals one. It mints the same OTP the self-service flow uses, so the user still chooses their own.

Audited: issuing a credential for another person is a staff act on that person's account, and it is exactly the kind of act that must be attributable afterwards.

The message is deliberately about the ATTEMPT. The code mail swallows SMTP failures so an outage cannot 500 this, and on a stack with no SMTP_HOST nothing is sent at all — so a caller must never read the 200 as delivery.