​
POST /auth/otp/request

​
string
required
Rate-limited 3 requests / 5 min per number, plus a 60s server-enforced resend cooldown. Always returns a generic {"status":"sent"} — even for an unregistered number, so the response never reveals whether a phone is registered.
200 OK
429 Too Many Requests (cooldown)

​
POST /auth/otp/verify

​
string
required
​
string
required
6 digits
Max 5 attempts per code before otp_too_many_attempts (429) — distinct from a plain wrong code (otp_invalid, 400). A code is single-use: correct verification immediately invalidates it. On success, creates the user (by phone) if this is their first login.
200 OK

​
POST /auth/operator/login

​
string
required
​
string
required
200 OK
When mustResetPassword is true, every other operator endpoint returns 403 forbidden ("Password reset required before using this endpoint") until POST /auth/operator/set-password is called — enforced server-side on every request via requireOperatorPasswordCurrent, not just signaled in this response for the client to honor voluntarily.

​
POST /auth/operator/set-password

Requires an operator bearer token (even one still flagged mustResetPassword).
​
string
required
​
string
required
min 8 chars
200 OK
There is no self-service forgot-password flow anywhere in this API — only an already-authenticated operator (via a temp password an admin issued) can set their own new password here. A locked-out operator can only be recovered by an admin calling POST /operators/{id}/reset-password (see Operators).

​
POST /auth/refresh

​
string
required
Rotates the refresh token — the old one is revoked in the same call, so it can’t be replayed even if leaked afterward.

​
POST /auth/logout

​
string
required
Revokes the given refresh token. Returns 204 No Content.