Account recovery

Explicitly resume an approved email change or deletion after partial provider failure.

Email changes and account deletions attempt provider work during the initiating request. Partial completion preserves the approved operation and its checkpoints. The account remains denied or in its contact transition until the required steps complete. These operations do not have a background retry queue, and the hourly cron does not resume them.

Customer retry

The signed-out status page shows progress and offers a retry while the customer’s receipt is valid. It resumes the same approved operation; it does not authorize a different change. Email verification still requires the appropriate verified sign-in. If the receipt has expired or the customer cannot return to that page, an operator can use the endpoint below without requiring the deleted identity to sign in again.

Operator retry

Configure the optional ACCOUNT_RECOVERY_SECRET on the Shop API. Use its dedicated bearer credential; Auth0 proxy, Action and ordinary user credentials are not accepted. Select the exact existing account subject, operation ID and purpose from the authorized operation being investigated. Never change a lifecycle row by hand to bypass a failure.

POST /internal/account/recover
Authorization: Bearer <ACCOUNT_RECOVERY_SECRET>
Content-Type: application/json

{
  "subject": "<exact Auth0 subject>",
  "operationId": "<existing approved operation ID>",
  "purpose": "delete"
}

Send this to your Shop API origin. The body accepts only these three fields: subject is 1–256 characters, operationId is 1–128 characters, and purpose is email or delete. The endpoint checks ownership, purpose and the persisted phase. It cannot start an operation from unconsumed identity proof, supply a new email or execute an arbitrary provider command. Keep credentials and account identifiers out of shared logs and screenshots.

Result	What to do
200 with `status: "complete"`	The exact operation is complete. Do not start another one.
200 with `status: "pending"`	Inspect the remaining provider condition and retry the same operation when appropriate.
200 with `status: "cancelled"`	The authorization was retired; this endpoint will not reopen it.
401	Check the dedicated recovery binding and bearer credential.
404 `recovery_not_found`	Verify the exact subject, operation and purpose; no matching resumable authorization was found.
409 `recovery_pending`	Recovery remains incomplete. Resolve the provider problem, then retry this same operation.

Provider error details stay private. A failed attempt preserves its checkpoints; repeating recovery does not grant fresh authority. Confirm the result in the status flow and provider state appropriate to the operation.

Payment cleanup for deleted accounts remains part of financial recovery. That schedule does not imply that account deletion or email provider work will finish automatically.