Create Delegated Recovery Challenge
Starts a recovery session for an end user under your brand, without sending a DFNS recovery email. Call this after you have verified the user’s identity with your own auth system.
The response returns a recovery challenge. Pass it to your frontend so the user can decrypt their recovery credential and sign, then call Recover User to complete the recovery and register fresh credentials.
Authentication
❌ Organization User (CustomerEmployee)❌ Delegated User (
EndUser)✅ Service Account
Required Permissions
Auth:Recover:Delegated: Always required.Authorizations
Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows
User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows
Body
Response
Success
JWT used to identify the registration session when calling Complete User Registration.
Challenge to be signed by the credential being registered.
Credential kinds that can be used to register the user.
Identifies the information needed to verify the user's signing certificate; can be one of the following:
- none: indicates no attestation data is required
- indirect: indicates the attestation data should be given, but that it can be generated using an Anonymization CA
- direct: indicates the attestation data must be given and should be generated by the authenticator
- enterprise: indicates the attestation data should include information to uniquely identify the user's device
none, indirect, direct, enterprise Public key credential parameters supported for the registration.
Credentials to exclude from the registration (already registered for the user).
URL to provision a TOTP credential, when applicable.
Deprecated. Should not be used.