Resend an email OTP for a change-password / forgot-password / signup flow. Always returns the same uniform "if registered, an OTP has been sent" message to avoid email enumeration.
Auth: Both — public, no authentication required. Sits in a separate slow-burn group (3 per 3 min; 1000 local). No authentication and no company scoping. The target is found by email: for change_password/forgot_password the latest User (its person.company_id is used for branding). For rs_signup the latest SignupActivation (company resolved via its referral code). An additional in-handler guard returns the uniform message without sending if 10+ OTPs were created for that email in the last hour (enumeration suspected).
Rate limit: 3 requests per 3 minutes.
Request
- Body:
| Field | Type | Required | Notes |
|---|---|---|---|
type | string | yes | One of change_password, forgot_password, rs_signup. |
email | string | yes | email:rfc,dns. Unknown / unregistered emails still return the uniform success message (no enumeration). |
Response — { data. } envelope. Uniform regardless of whether the email exists or an OTP was actually sent.
status(string) — alwayssuccess.response(string) —If the email address is registered, a one time password has been sent.
Errors: 422 on validation failure.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||