# Confirm admin token recovery

Confirms admin token recovery with the verification code. This proxies to the FASP server without the admin token (forgot-token flow). The action is audit-logged. Requires Federation.Manage permission.

RBAC: requires Federation.Manage

Endpoint: POST /api/v1/admin/fasp-remote/token/recover/confirm
Version: 1.0
Security: header

## Request fields (application/json):

  - `email` (string, required)
    Admin email address

  - `code` (string, required)
    Verification code received via email

## Response 200 fields (application/json):

  - `success` (boolean, required)
    Whether the token rotation was successful

  - `newTokenMasked` (string,null)
    Masked new admin token


## Response 400 fields