Resend email OTP

Overview

Resend an email OTP for a change-password / forgot-password / signup flow. Always returns the same uniform "if registered, an OTP has been sent" message to avoid email enumeration.

Prerequisites

• No authentication — this endpoint is public.

Base URL

Endpoint

POST /api/v1/resend/email/otp

Authentication

• No bearer token is required. This public endpoint has no company scoping.
• The endpoint uses a separate rate-limit group (3 requests per 3 minutes; 1,000 local).
• It finds the target by email.
• For change_password and forgot_password, it uses the latest User and that user's person.company_id for branding.
• For rs_signup, it uses the latest SignupActivation and resolves the company through its referral code.
• If 10 or more OTPs were created for an email address in the last hour, an in-handler guard steps in. It returns the same uniform response without sending an email.

Rate limit

• 3 requests per 3 minutes.

Request body

• Body:

{
  "type": "forgot_password",
  "email": "[email protected]"
}

Response

• data.status (string) — always success.
• data.response (string) — If the email address is registered, a one time password has been sent.

200 OK · 200

{
  "data": {
    "status": "success",
    "response": "If the email address is registered, a one time password has been sent."
  }
}

Errors

Example request

curl --request POST \
  --url "https://production-api.shoutaboutus.com/api/v1/resend/email/otp" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"type": "forgot_password", "email": "[email protected]"}'