Verify the email OTP previously sent for a forgot-password / change-password / signup flow. On success for forgot_password it returns a short-lived Passport access token used to complete the password reset.

Auth: Both — public, no authentication required. Sits in the 10 requests/min per-IP throttle group with no authentication. The endpoint scopes the target by email + type: it looks up the latest User (for change_password/forgot_password) or latest SignupActivation (for rs_signup) by email, then matches the newest unexpired, unverified Otp row of that category. No company/role scoping — any caller who knows the email and a valid OTP can verify. Role only differs in that the returned token is only included for the forgot_password type.

Rate limit: 10 requests/min per IP.

Request

• Body:

Response — { data. } envelope.

• status (string) — always success on a verified OTP.
• response (string) — The one time password has been verified successfully.
• token (string) — Passport personal access token; present ONLY when type=forgot_password (used to authorize the subsequent users/reset/password call). Absent for change_password and rs_signup.

Errors: 422 on validation failure.