Ask for a recovery link

POST

/security/recovery/start

For an account its own access rules (or a lockdown) lock out. Emails
a one-time link to the console (#/recover?code=…), good for 30
minutes. The answer is the same whether or not the address has an
account. At most 10 requests an hour from one client address (429),
and — silently, so as not to say the address exists — 3 links an
hour per account.

Capability: none from the table; the credential is its own (see above). An email address; rate-limited; the same answer for every address.

Request

Body Params application/jsonRequired

Examples

Responses

🟢202

application/json

If the address has an account, a link is on its way

Bodyapplication/json

🟠429

🟠400ValidationError

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/recovery/start' \
--header 'Content-Type: application/json' \
--data-raw '{
    "email": "user@example.com"
}'

Response Example

202 - Example 1

{
    "message": "string"
}

Modified at 2026-10-05 04:04:32

Acknowledge a team finding

Recover access with the emailed code