Validates the SMS code (from /recover/username/request). When one or more AppUsers are linked to the verified recovery number, their username(s) are sent by SMS to that stored recovery phone in a single message. Legacy phone-number placeholders are never included; the response instead signals that migration is required. The API never returns usernames or the match count. When no account matches, the endpoint still returns the same success-shaped confirmation with a masked destination.

Access: Public endpoint.