---
title: "Get recovery codes"
method: GET
path: "/admin/2fa/recoverycodes"
tags: ["admins"]
---

# Get recovery codes

`GET /admin/2fa/recoverycodes`

Returns the recovery codes for the logged in admin. Recovery codes can be used if the admin loses access to their second factor auth device. Recovery codes are returned unencrypted

## Response `200`

successful operation

- RecoveryCode[]
  - `secret` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
    - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
    - `payload` string
    - `key` string
    - `additional_data` string
    - `mode` integer — 1 means encrypted using a master key
  - `used` boolean

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error
- `default` — Unexpected Error

---

[API](https://skmtc.net/kanton-bern/apis/sftpgo.md) · [All operations](https://skmtc.net/kanton-bern/apis/sftpgo/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kanton-bern/sftpgo/versions/d8d616a479b0/schema)