# GET /api/v1/recover/confirm

Auth: public

HTML: https://cooperemail.com/docs/reference/recover-confirm

## Summary

Human recovery link. GET shows a confirm page and does not revoke keys. POST from that page revokes the account API keys and OAuth access and refresh tokens in the same transaction, and shows a new full-access key once. The POST needs the nonce from that page. A POST without it does not mint a key. The key is not emailed and is not stored. A second POST does not show the key. An expired or already used link does not mint a key. An API key cannot submit the link (403 owner_channel_required). Reply-To on the recovery email is noreply@cooperemail.com. A copy of the link that arrives in an agent inbox is redacted, including a percent-encoded or quoted-printable copy, and that token is marked used.

## Request

This call has no JSON body.

## Response

The OpenAPI document does not declare a JSON response schema for this call. The summary is the contract.

## Errors

- HTTP 403 owner_channel_required

The live `message` is the sentence for that code. Branch on `code`.

```json
{
  "error": {
    "type": "authentication_error",
    "code": "owner_channel_required",
    "docs_url": "https://cooperemail.com/docs#owner_channel_required"
  }
}
```

## Idempotency

This route does not document Idempotency-Key or client_id.