API referenceAccount
Generate recovery codes
POST
Rotates the caller's recovery codes: every existing code is invalidated and a fresh set is returned once. The caller must store them; only hashes persist server-side.
CognitoUserPoolheader
AuthorizationBearer <token>Cognito user pool ID token. API Gateway validates the token (identity
token: no OAuth scopes are configured on the authorizer) and forwards
its claims; the sub claim is the tenant key.
The new codes, shown exactly once.
application/json- response
codes*array<string>One-time recovery codes, returned only at generation. Store them somewhere safe; they cannot be retrieved again.
curl -X POST "https://example.com/account/recovery-codes"{ "codes": [ "string" ]}