در حال بارگذاری…
Resets the user's password using the 6-digit verification code received via SMS.
This endpoint does not require authentication. Rate limited to 5 requests per minute per IP address.
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| phone | string | Yes | Phone number the code was requested for. Max 32 characters | "+989123456789" |
| code | string | Yes | 6-digit verification code received via SMS | "123456" |
| password | string | Yes |
| New password (minimum 8 characters) |
| "newpassword123" |
| password_confirmation | string | Yes | Confirmation of the new password | "newpassword123" |
POST /api/v1/auth/reset-password/reset
Content-Type: application/json
{
"phone": "+989123456789",
"code": "123456",
"password": "newpassword123",
"password_confirmation": "newpassword123"
}
Returns a success message when the password is reset successfully.
{
"message": "Password has been reset successfully."
}
The reset also sets the account's phone_verified_at: entering the code proved control of the number just as
registration does. It is never accepted from the request. See GET /api/v1/users for the
phone_status filter that reads it.
| Status | Description | Reference |
|---|---|---|
| 422 | Validation error (invalid input/code) | See below |
| 429 | Too many requests | Rate-limit error |
Invalid code (wrong digits, no code requested, an unregistered phone number, or the code was burned after 5 wrong guesses):
{
"message": "Invalid reset code.",
"errors": {
"code": ["Invalid reset code."]
}
}
Expired code (only ever returned for the right digits; a wrong code on an expired token is Invalid reset code):
{
"message": "Reset code has expired.",
"errors": {
"code": ["Reset code has expired."]
}
}
Password validation errors:
{
"message": "The password field must be at least 8 characters.",
"errors": {
"password": ["The password field must be at least 8 characters."]
}
}
{
"message": "The password confirmation field must match password.",
"errors": {
"password": ["The password confirmation field must match password."]
}
}
Phone validation:
{
"message": "The phone field is required.",
"errors": {
"phone": ["The phone field is required."]
}
}
422 as a wrong code: this endpoint does not reveal whether a number has an account either