Skip to main content

​
Overview

Starts a recovery process when a user has lost access. The server may send a recovery email, request peer approval, or notify the operator depending on the account status. This endpoint can be called without an existing session.

​
HTTP request

POST /Agent/Account/Recover

​
Authentication

No authentication required.

​
Request body

{
  "userName": "alice",
  "personalNr": "",
  "country": "",
  "eMail": "alice@example.com",
  "phoneNr": ""
}
FieldTypeRequiredDescription
userNamestringconditionalUsername of the account to recover.
personalNrstringconditionalPersonal number from a legal identity.
countrystringconditionalCountry code for personalNr.
eMailstringconditionalEmail registered with the account.
phoneNrstringconditionalPhone number registered with the account.
Rules:
  • Provide at least one of userName or personalNr.
  • If personalNr is provided, country is required.
  • Provide at least one contact method: eMail or phoneNr.

​
Internal process

  • Accounts without assets or legal identities receive a recovery email.
  • Peer-reviewed identities trigger peer signature requests.
  • Operator-approved accounts notify the operator for manual handling.

​
Security notes

  • The endpoint is audited and rate-limited.
  • No success status is returned to avoid information leakage.

​
Error handling

If multiple accounts match the same personalNr and country and no userName is provided, the server returns HTTP 422.