Loading…
Initiates a password reset process by sending a 6-digit verification code via SMS to the user's phone number.
This endpoint does not require authentication. Rate limited to 5 requests per minute per IP address.
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| phone | string | Yes | User phone number (must be registered in the system) | "+989123456789" |
POST /api/v1/auth/reset-password/request
Content-Type: application/json
{
"phone": "+989123456789"
}
Returns a success message when the reset code SMS is sent successfully.
{
"message": "Password reset code has been sent to your phone."
}
| Status | Description | Reference |
|---|---|---|
| 422 | Validation error (invalid phone number) | See below |
| 429 | Too many requests | Rate-limit error |
| 500 | SMS sending failed | See below |
{
"message": "The phone field is required.",
"errors": {
"phone": ["The phone field is required."]
}
}
{
"message": "The selected phone is invalid.",
"errors": {
"phone": ["The selected phone is invalid."]
}
}
{
"message": "Failed to send SMS. Please try again."
}
422 and
"The selected phone is invalid.", while a registered one returns 200. Treat it as enumerable and rely on
the rate limit below rather than on ambiguity