Skip to main content
POST
Create

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization
string
header
required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The RecoveryPolicyServiceCreateRequest message.

displayName
string
required

A human-readable name for the policy.

allowedRecoveryTypes
enum<string>[] | null

The credential types a user may use to recover access.

Available options:
CREDENTIAL_TYPE_UNSPECIFIED,
CREDENTIAL_TYPE_PASSKEY,
CREDENTIAL_TYPE_PASSWORD,
CREDENTIAL_TYPE_TOTP,
CREDENTIAL_TYPE_EMAIL_OTP,
CREDENTIAL_TYPE_RECOVERY_CODE,
CREDENTIAL_TYPE_DELEGATED_GOOGLE,
CREDENTIAL_TYPE_DELEGATED_MICROSOFT,
CREDENTIAL_TYPE_UPSTREAM_IDP
minRecoveryAuthLevel
enum<string>

The minimum assurance level a recovery ceremony must reach.

Available options:
AUTH_LEVEL_UNSPECIFIED,
AUTH_LEVEL_NONE,
AUTH_LEVEL_SINGLE_FACTOR,
AUTH_LEVEL_MULTI_FACTOR,
AUTH_LEVEL_PHR,
AUTH_LEVEL_PHRH
priority
integer<int32>

When a user matches more than one policy, the policy with the highest priority applies.

revokeOnRecovery
boolean

When true, a successful recovery revokes existing credentials and forces re-enrollment.

Response

200 - application/json

Successful response

The RecoveryPolicyServiceCreateResponse message.

recoveryPolicy
Recovery Policy · object | null

RecoveryPolicy defines how users recover access when they lose their credentials.