# New Recovery Codes

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

Ten new recovery codes; the old ones stop working.

## Overview

- `code`: a current code of the authenticator app. `200` with `recoveryCodes`, shown only now (`Cache-Control: no-store`).
- `400` `MFA_CODE_INVALID`; `409` `MFA_NOT_ENROLLED` without an app, `MFA_OFF` where second factors are not in use; `403` `MFA_NOT_AVAILABLE`. 20 requests per minute per client IP.

## Endpoint

### `POST /v1/auth/mfa/recovery-codes`

Authentication: bearer token required.

Replaces the recovery codes, with a current code.

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | string | yes | Six digits from the authenticator app |

**Responses**

`200` OK

```json
{
  "recoveryCodes": [
    "F4KQN-7WZP2", "M9TXB-3HLD6", "Q2VRJ-8CNF5", "D7PLW-4KXM9", "Z3HBT-6RQJ2",
    "L8NCV-2PWD7", "G5XKM-9TBQ3", "S2JFR-7LVH8", "V6DQN-3MZK4", "E9WPT-5CXB2"
  ]
}
```

`409` Not enrolled

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "No second factor is enrolled",
  "details": { "code": "MFA_NOT_ENROLLED" }
}
```

---

Web version: https://docs.aureahub.com/#mfa-recovery-codes