neosourceDocs
Search docs

Regenerate TOTP recovery codes

POST/api/auth/totp/recovery-codes/regenerate

regenerateRecoveryCodes

Atomically invalidates the existing recovery-code set and returns 10 freshly-minted codes (plans/auth-flows.md slice #3). The codes are surfaced **exactly once** — the SPA must show them and the user must save them. Returns 409 with `error: "totp_not_enabled"` if the account does not have TOTP enabled. A security-notice email is sent to the verified address. **Requires sudo-mode** (plans/auth-flows.md slice #5). Returns `403 { error: "sudo_required", challenge: "password" }` if the sudo window has elapsed.

Requires authentication using a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/totp/recovery-codes/regenerate' \
  -b 'ns_session=$NEOSOURCE_SESSION'

fetch

fetch("https://neosource.dev/api/auth/totp/recovery-codes/regenerate", {
  method: "POST",
  credentials: "include",
});

Responses

200Recovery codes regenerated and returned once

application/json

RegenerateRecoveryCodesResponse

object

Response body for `POST /api/auth/totp/recovery-codes/regenerate`. Same `recovery_codes` shape as `TotpConfirmResponse`; lives in its own struct so `OpenAPI` surfaces a distinct schema name for the regenerate endpoint.

recovery_codesrequired

array

items

string

403Forbidden — one of: forbidden, sudo_required

application/json

one of
  • ErrorForbidden

  • SudoRequiredError

    object

    Wire shape of the 403 a sudo-gated endpoint returns when sudo is missing or expired. `challenge` tells the SPA which sudo-prove endpoint to call.

    challengerequired

    string

    Which sudo-prove endpoint the account should use: `"passkey"` (`/api/auth/sudo/passkey/{start,finish}`), `"password"` (`/api/auth/sudo/password`), or `"totp"` (`/api/auth/sudo/totp`), chosen from the account's registered credentials — passkey first when present, since it is both the strongest credential and the least friction. A hint for which prompt to show first, not an authorization decision: each sudo route verifies its own credential regardless of what was advertised here, so a client may use a different one.

    errorrequired

    string

    Always `sudo_required` — this body exists to carry the extra fields that kind needs.

    "sudo_required"

    messagerequired

    string

Standard errors

Bodies documented once for the whole API — see standard errors.

  • 400Bad Request — one of: invalid_input
  • 401Authentication required
  • 429Rate limited — retry after the `Retry-After` header
  • 500Internal server error
  • 503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
  • 504Gateway timeout — the request exceeded the server's handling budget