Restore Password with OTP

The POST /v2/restorePasswordOTP endpoint enables users to securely reset their password using a One-Time Password (OTP) sent to their registered email address. The caller must supply the OTP code together with a new password and its confirmation to complete the reset. If the OTP is valid and all fields pass validation the endpoint removes the current password and replaces it with the new one.

Endpoint

POST /v2/restorePasswordOTP

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint as the second step in the two-step password recovery flow: after calling the forgot-password endpoint (which dispatches an OTP to the user's email), call this endpoint to validate the OTP and commit the new password. This is the appropriate endpoint whenever a user has lost access to their account password and needs to regain it through a verified, OTP-gated reset rather than a simple in-session change.

Request Body

{
  "nickName": "john.doe",
  "code": "847291",
  "password": "N3wS3cur3P@ssw0rd!",
  "passwordConfirm": "N3wS3cur3P@ssw0rd!"
}

Response

200 OK

{
  "restoreState": "Success",
  "errors": null,
  "success": "Password has been successfully restored."
}

Example failure response (invalid OTP):

{
  "restoreState": "Failed",
  "errors": [
    "The provided OTP code is invalid or has expired."
  ],
  "success": null
}

Error Codes

Common Mistakes

• Sending password and passwordConfirm with different values — both fields must be identical or the request will be rejected.
• Using an expired or already-consumed OTP code — OTP codes are single-use and time-limited; request a new OTP via the forgot-password endpoint if the code has expired.
• Omitting nickName — the request schema inherits nickName as a required field from the base forgot-password model; leaving it out will trigger a 400 validation error.
• Submitting empty strings for any required field — all four fields enforce minLength: 1.

Related Endpoints

• POST /v2/forgotPassword — Initiates the password recovery flow by sending an OTP to the user's registered email
• POST /api/auth/v2 — Authenticates a user and returns a Bearer token after a successful password restore
• POST /api/auth/refresh — Refreshes an expiring Bearer token

Example

curl -X POST https://api.banking.netevia.dev/v2/restorePasswordOTP \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "nickName": "john.doe",
    "code": "847291",
    "password": "N3wS3cur3P@ssw0rd!",
    "passwordConfirm": "N3wS3cur3P@ssw0rd!"
  }'