Reset password using OTP code. CONDITIONAL ID GATE: when the target AppUser has a ficaEntity linked (i.e. has been through wallet-FICA), the request MUST also supply idNumber matching the stored entity ID. Pre-FICA accounts fall back to phone-OTP alone. Errors: 400 ID_VERIFICATION_REQUIRED when ID is missing on a FICA-bound account; 401 ID_VERIFICATION_FAILED when ID is supplied but does not match. The FE should branch on the error code to render the right prompt — never on the human message.
Access: Public endpoint.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Password reset successfully
ID_VERIFICATION_REQUIRED — account is FICA-bound and idNumber was omitted from the request body. The FE should prompt the user to enter their FICA-time ID number and resubmit.
Invalid or expired OTP, OR ID_VERIFICATION_FAILED — supplied idNumber does not match the stored FICA entity ID. Errors are returned generically so timing cannot distinguish "wrong OTP" from "wrong ID"; the FE routes off the error code.