در حال بارگذاری…
Initiates a password reset process by sending a 6-digit verification code via SMS to the user's phone number.
This endpoint does not require authentication. Rate limited to 5 requests per minute per IP address.
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| phone | string | Yes | Phone number to send the reset code to. Max 32 characters | "+989123456789" |
POST /api/v1/auth/reset-password/request
Content-Type: application/json
{
"phone": "+989123456789"
}
Returned for every well-formed phone number, registered or not, with the same body. A code is generated and sent only when the number belongs to an account; an unregistered number gets this response and no SMS.
{
"message": "If an account exists for this number, a reset code has been sent."
}
| Status | Description | Reference |
|---|---|---|
| 422 | Validation error (phone missing or too long) | See below |
| 429 | Too many requests | Rate-limit error |
| 500 | SMS sending failed | See below |
{
"message": "The phone field is required.",
"errors": {
"phone": ["The phone field is required."]
}
}
{
"message": "Failed to send SMS. Please try again."
}
200 above and stops: no code, no SMS200 and body. Clients must therefore move to the code screen either way; an unregistered number's code is simply
never accepted. Accepted residual: the 500 SMS failure can only happen for a registered number, because only
a registered number is ever sent a code. Hiding it would leave a real user waiting for an SMS that never comes500 above; that is a separate change (SMS.ir is listed as
inline debt in rules/queues-and-jobs.md)