Prior auth approved, then retroactively denied after the procedure - is this legal?

I need help understanding if what my insurance company did is actually allowed. Back in December my doctor's office obtained prior authorization for a surgical procedure. We got the approval in writing, with an authorization number and everything. The procedure was scheduled and done in February.

Now in April I'm getting a bill from my surgeon's office for $6,400 because my insurance company retroactively denied the claim. Their reason is that they are now saying the procedure did not meet their "clinical criteria for medical necessity." But this was the same clinical criteria they evaluated when they granted the prior auth two months earlier.

My doctor's office says they have never seen this happen before. The insurance company rep I spoke to said their clinical team "re-reviewed" the case and changed the determination. I got sick during the authorization review or something, I honestly cant follow their explanation.

I have the written authorization on file with the authorization number. I did everything right. Can they actually do this? Do I have any real recourse here?