Passwordless login by Phone with profile

POST 
/identity/v2/auth/login/passwordlesslogin/otp

POST variant of passwordless login by Phone. The phone identifier (PhoneId) and the full registration profile are supplied in the JSON body (same schema as /auth/register). When passwordless phone auto-registration is enabled, a previously-unknown phone number is auto-registered with the supplied profile fields, and the request must carry a valid SOTT or CAPTCHA. This endpoint registers by phone only — Email, UserName and Password are not part of the request body and are ignored if sent (not validated and not stored). Sending the profile in the body (instead of query parameters) keeps PII out of URLs and logs.

Request

Responses

200

Success

400

Bad Request

401

Status Unauthorized: The request requires User authentication.

403

Forbidden

429

Too Many Requests: The client has sent too many requests in a given amount of time.

Response Headers

X-RateLimit-Limit
Refill rate of the bucket that rejected this request: requests per second for the tenant bucket, or requests per refill window (60 seconds by default) for the per-IP bucket.
Example: 100
X-RateLimit-Remaining
Tokens left in that bucket.
Example: 0
X-RateLimit-Reset
Unix timestamp, in seconds, at which the next token becomes available. This is the earliest time a retry can succeed.
Example: 1757942400

500

Internal Server Error - an unexpected error occurred on the server.