Skip to main content

generateOrgRecoveryCodes

Generates a fresh batch of one-time recovery codes for the organization, replacing any existing unused codes. The plaintext codes are returned EXACTLY ONCE — the server stores only Argon2id verifiers and cannot recover the plaintext later. The UI must prompt the user to download or print the codes immediately. Emits a recovery_codes_generated SecurityAuditEvent.

generateOrgRecoveryCodes(
  orgID: String!
  count: Int!
): [String!]!

Arguments​

generateOrgRecoveryCodes.orgID ● String! non-null scalar​

Keycloak organization alias.

generateOrgRecoveryCodes.count ● Int! non-null scalar​

Always 10 today. Forced server-side. Required-but-validated for forward-compat with future variable batch sizes.

Type​

String scalar​

The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.