{
  "schema_version": "1.0",
  "id": "credential-recovery",
  "title": "Credential Recovery",
  "summary": "Recovery replaces credentials; existing secrets are never recovered or emailed.",
  "sections": {
    "request": "POST /v1/security/recovery returns a generic anti-enumeration response.",
    "verify": "A strong, short-lived, single-use email link proves control of the verified email channel.",
    "review_options": [
      "mine",
      "not_mine",
      "secure"
    ],
    "completion": "Denied or uncertain activity revokes the affected key or all keys and may issue a new secret once.",
    "high_risk": "High/critical events require external step-up or manual review before replacement."
  },
  "version": "2026-08-v6",
  "effective_at": "2026-08-10T00:00:00Z",
  "content_hash": "sha256:464b2f5e0a8dc6f59e1b3fd42a83ba432e3d35a5818d4f1050b0986c33207dad"
}