Herald
OpenapiUser

Regenerate TOTP secret and backup codes

Generates a new TOTP secret and backup codes, staged for swap: the old secret and backup codes remain valid until the user verifies a code from the new secret; abandoning the flow (or a failed verification) leaves them intact, so 2FA is never silently disabled. Requires a single-use reauth ticket obtained by verifying any one of the user's factors (password, TOTP, or Passkey) via `POST /api/user/reauth/verify` (see `consume_reauth`).

POST
/api/user/totp/regenerate

Generates a new TOTP secret and backup codes, staged for swap: the old secret and backup codes remain valid until the user verifies a code from the new secret; abandoning the flow (or a failed verification) leaves them intact, so 2FA is never silently disabled. Requires a single-use reauth ticket obtained by verifying any one of the user's factors (password, TOTP, or Passkey) via POST /api/user/reauth/verify (see consume_reauth).

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

reauth_token*string

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/user/totp/regenerate" \  -H "Content-Type: application/json" \  -d '{    "reauth_token": "string"  }'
{  "backupCodes": [    "string"  ],  "qrCodeUrl": "string",  "secret": "string",  "tempToken": "string"}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}