Create Delegated Recovery Challenge
Starts a recovery session for an end user under your brand, without sending a Dfns recovery email. Call this after you have verified the user’s identity with your own auth system.
The response returns a recovery challenge. Pass it to your frontend so the user can decrypt their recovery credential and sign, then call Recover User to complete the recovery and register fresh credentials.
Documentation Index
Fetch the complete documentation index at: https://docs.dfns.co/llms.txt
Use this file to discover all available pages before exploring further.
Authentication
❌ Organization User (CustomerEmployee)❌ Delegated User (
EndUser)✅ Service Account
Required Permissions
Auth:Recover:Delegated: Always required.Authorizations
Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows
User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows
Body
Response
Success
Identifies the information needed to verify the user's signing certificate; can be one of the following:
- none: indicates no attestation data is required
- indirect: indicates the attestation data should be given, but that it can be generated using an Anonymization CA
- direct: indicates the attestation data must be given and should be generated by the authenticator
- enterprise: indicates the attestation data should include information to uniquely identify the user's device
none, indirect, direct, enterprise 