Skip to main content

generateOrgRecoveryCodesWithPassphrase

Strict/airgapped variant of generateOrgRecoveryCodes. Verifies the passphrase per-action, derives the KEK transiently, and builds the kw_recovery_v1 escrow atomically so a later passphrase reset can recover encrypted data. Required in strict mode (the plain mutation refuses there). Plaintext codes are returned EXACTLY ONCE.

generateOrgRecoveryCodesWithPassphrase(
  orgID: String!
  count: Int!
  passphrase: String!
): [String!]!

Arguments​

generateOrgRecoveryCodesWithPassphrase.orgID ● String! non-null scalar​

Keycloak organization alias.

generateOrgRecoveryCodesWithPassphrase.count ● Int! non-null scalar​

Always 10 today. Forced server-side. Required-but-validated for forward-compat with future variable batch sizes.

generateOrgRecoveryCodesWithPassphrase.passphrase ● String! non-null scalar​

Org passphrase, verified per-action to derive the transient KEK.

Type​

String scalar​

The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.