Page History

...

Token API is a special API for requesting and getting one-time tokens for different operations regarding a user's profile.

Unauthorized user

Operations:

...

• Registration
  • api/v1/token/registration/{{processingId}} - registration OTT (email or phone number, depending on which option has been chosen by the user) 
    
    responseBody: {
                                "destination": "email@gmail.com/+123456789", 
                                "expiration": "30min."
                               }
    
    

• Login | switchable depends on MFA
  • login/email", "api/v1/token/login /mobile" or "api/v1/token/login/email"
    - get email/phone number OTT (MFA) 
    
    requestBody: {
                              "destination": "EMAIL/PHONE_NUMBER",
                              "processingId": UUID
                            }
    
    responseBody: {
                                "destination": "email/phoneNumber",
                                "expiration": "30min."
                               }
    
    
• Reset password
  Change password
  • get OTT (email by default, if there is no email, then phone number) – "api/v1/token/password"
    
  Reset password
  • /recovery - get OTT (email or phone number, depending on which option has been chosen by user) – "the user) 
    
    requestBody: {
                              "destination": "EMAIL/PHONE_NUMBER",
                              "processingId": UUID
                            }
    responseBody: {
                                 "destination": "email/phoneNumber",
                                 "expiration": "30min."
                               }
    
    
  • User key recovery | switchable depends on MFA 
    
    • api/v1/token/userKeys/recovery/password"
      
    Reset user key (security)
    • verification - get email/phone number OTT for verification 
    • get phone number OTT for verification
    • + validate if recovered type not passed as OTT
      
      requestBody: {
                                "processingId": UUID
                               } 
      
      responseBody: {
                                  "destination": "email/phoneNumber",
                                  "expiration" "30min.": 
                                  }
      
      
    • get email OTT for changing email – "api/v1/token/userKeys/recovery/security/email"get newKey - get email/phone number OTT for changing phone number – "user key
      
      requestBody: {
                                "destination": "email@gmail.com/+123456789", 
                                "processingId": UUID
                               } 
      
      responseBody: {
                                   "expiration": "30min."
                                 }
      
      

  Authorized user

  Operations:

  • Change password
    • api/v1/token/recovery/security/mobile"
      
    Registration
    • registration password/changing - get OTT (email or phone number, depending on which option has been chosen by user) – "api/v1/token/registration"

  Authorized user

  Operations:

  • • by default, if there is no email, then phone number)  
      
      responseBody: {
                                   "destination": "email@gmail.com/+123456789",
                                   "expiration": "30min"
                                 }
      
      
  • User key management
    
    • api/v1/token/userKeys/adding/email?newEmail=email@email.com - get OTT to add new email
    
              responseBody: {
                                           "expiration": "30min."
                                          }
    
    
    • api/v1/token/userKeys/adding/phoneNumber?newPhoneNumber=+123456789 - get OTT to add new phone_number
    
              responseBody: {
                                           "expiration": "30min."
                                          }
    
    
    • api/v1/token/userKeys/changing?keyType=EMAIL/PHONE_NUMBER - get OTT to change existing email/phone_number + check if MFA for a chosen key is disabled, if not then firstly user has to disable mfa
      
      responseBody: {
                                   "expiration": "30min."
                                 }
      
      
    • api/v1/token/userKeys/changing/newKey - get OTT for a new email/phone_number to complete the user key changing flow
    
              requestBody: {
                                        "oneTimeToken": "previous step ott",
                                        "newUserKey": "email@gmail.com/+123456789"
                                       }
    
    
    • api/v1/token/userKeys/removing?keyType=EMAIL/PHONE_NUMBER - get OTT to remove user email/phone_number + check if MFA for a chosen key is disabled, if not then firstly user has to disable mfa 
      
      responseBody: {
                                   "expiration": "30min."
                                 }
      
      
      
  • Anti-phishing code | switchable depends on anti-phishing
    • "api/v1/token/antiPhishing/changing" - get OTT to change anti-phishing code (works only through email)
      
      responseBody: {
                                   "expiration": "30min."
                                 }
    • "api/v1/token/antiPhishing/adding" - get OTT to add anti-phishing code (works only through email)
      
      responseBody: {
                                   "expiration": "30min."
                                 }
      
      
  • Disable MFA | switchable, depends on MFA
    Email managmentget OTT passing required operation: change/remove email, change/remove anti-phishing code – "api/v1/token/email"
    Phone number managementget OTT passing required operation: change/remove phone number – "api/v1/token/mobile"
    Add emailget OTT – "api/v1/token/emailAdding"
    Add phone numberget OTT – "api/v1/token/mobileAdding"
    Disable MFA
    • get email OTT – "api/v1/token/mfa/email"get phone number OTT – "api/v1/token/mfa/mobile"disabling - get email/phone number OTT + reject if destination MFA is disabled
      
      requestBody: {
                                "destination": "EMAIL/PHONE_NUMBER", 
                               }
      
      responseBody: {
                                   "destination": "email/phoneNumber",
                                   "expiration": "30min."
                                 }