---
title: "Send Access Code"
method: POST
path: "/users/{user_id}/send-access-code"
tags: ["users"]
---

# Send Access Code

`POST /users/{user_id}/send-access-code`

## Request

- Base URL: `https://app.zeno-works.ch` (the document declares no server; this is the origin it was published from)
- URL: `https://app.zeno-works.ch/users/{user_id}/send-access-code`
- Auth: none declared

Email a locked-out user a fresh single-use sign-in code (admin surface P12).

The other half of the invite: for someone who was provisioned before this existed, or
whose invite mail never arrived, or who simply cannot reach the self-service reset.
Without it an administrator's only option is to set a password on the user's behalf and
send it over some channel — which means an admin choosing a customer's credential and
transmitting it in plaintext.

This never sets a password and never reveals one. It mints the same OTP the
self-service flow uses, so the user still chooses their own.

Audited: issuing a credential for another person is a staff act on that person's
account, and it is exactly the kind of act that must be attributable afterwards.

The message is deliberately about the ATTEMPT. The code mail swallows SMTP
failures so an outage cannot 500 this, and on a stack with no `SMTP_HOST` nothing is
sent at all — so a caller must never read the 200 as delivery.

## Path parameters

- `user_id` string, required

## Headers

- `authorization` string, nullable

## Cookies

- `access_token` string, nullable

## Response `200`

Successful Response

- MsgResponse: The ``{"msg": "..."}`` envelope — the error contract and many successes.
  - `msg` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zeno-works/apis/zeno-api.md) · [All operations](https://skmtc.dev/zeno-works/apis/zeno-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zeno-works/apis/zeno-api/revisions/1eb93dde146c?raw)