/Docs

Retrieve Recovery Codes

This API is used to retrieve Recovery Codes for a User.

Request#

API Key Authentication
Retrieve Recovery Codes (deprecated)
GET/api/user/two-factor/recovery-code/{userId}
OpenAPI Spec
Deprecated since 1.64.0
This endpoint is deprecated. To provide access to a user's recovery codes, generate new recovery codes and deliver those

As of 1.68.0, this endpoint always returns an empty list. Recovery codes are now hashed at rest and cannot be retrieved in plaintext. To provide a user with recovery codes, generate a new set.

Request Parameters#

userIdUUIDrequired

The Id of the User to retrieve Recovery Codes for.

Response#

The response for this API contains the remaining Recovery Codes that are assigned to the User. Each time one is used it is removed, so this response will contain between 0 and 10 codes. Prior to 1.68.0, this returned remaining codes. As of 1.68.0, this always returns an empty list.

Response Codes
CodeDescription
200The request was successful. The response will contain a JSON body.
400The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body#

recoveryCodesArray<String>

The array of Recovery Codes.

Example Response JSON

{
  "code": "752185",
  "recoveryCodes": [
    "QJD73-L6GR5",
    "R7RJH-GB7H3",
    "JJ5YZ-KS4C3",
    "CRDHP-7L355",
    "928QS-P9HMJ",
    "8VLFT-Z2WMM",
    "PQZX9-YV5VR",
    "TK9TB-7BT6H",
    "6QYPL-ZPQJV",
    "VJ35W-98RW4"
  ]
}