Resend SMS OTP code

1 min

POST

https://api.upstartcommerce.com/api/v1/auth/mfa/resend

Resends the SMS OTP code for an existing MFA challenge. Only available for SMS MFA method.

Body Parameters

bodyMfaResendRequestrequired
Example
```
{
  "challengeId": "ch_abc123xyz"
}
```
Description
Challenge ID for resending OTP
- challengeIdstringrequired
  Example
  ch_abc123xyz
  Description
  MFA challenge ID from login response

Responses

200OTP resent successfully

MfaChallengeResponse
Example
```
{
  "challengeId": "ch_abc123xyz",
  "method": "sms",
  "expiresIn": 300,
  "maskedPhoneNumber": "***1234"
}
```
Description
MFA challenge information
- challengeIdstringrequired
  Example
  ch_abc123xyz
  Description
  Unique identifier for the MFA challenge
- methodstring<totp | sms>required
  Example
  sms
  Description
  MFA method
  Allowed
  totpsms
- expiresIninteger<int64>required
  Example
  300
  Description
  Seconds until challenge expires
  Format
  int64
- maskedPhoneNumberstring
  Example
  ***1234
  Description
  Masked phone number (for SMS only)

400Invalid request or not SMS MFA

ErrorResponse
Example
```
{
  "error": "invalid_request",
  "message": "Resend only available for SMS MFA",
  "code": "BAD_REQUEST"
}
```
Description
Standard error response format
- errorstringrequired
  Example
  unauthorized
  Description
  Error type identifier:
  
  invalid_request: Malformed request or missing required fields
  
  unauthorized: Invalid credentials or token
  
  account_not_verified: Account exists but email/phone not verified
  
  session_expired: Maximum session lifetime exceeded, full re-login required
  
  unauthorized_tenant: User not authorized for requested tenant
  
  tenant_required: Multi-tenant user must specify tenant
  
  unauthorized_site: User not authorized for requested site
  
  site_required: Site context required for this operation
  
  no_authorized_sites: User has no authorized sites
  
  forbidden: Access denied (e.g., no authorized tenants)
  
  rate_limited: Too many requests, try again later
  
  account_locked: Account temporarily locked due to failed attempts
  
  internal_error: Server-side error
- messagestringrequired
  Example
  Invalid username or password
  Description
  Human-readable error description
- codestring<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>required
  Example
  UNAUTHORIZED
  Description
  HTTP status code name
  Allowed
  BAD_REQUESTUNAUTHORIZEDUNAUTHORIZED_TENANTTENANT_REQUIREDFORBIDDENRATE_LIMITEDACCOUNT_LOCKEDINTERNAL_SERVER_ERROR

401Challenge expired

ErrorResponse
Example
```
{
  "error": "unauthorized",
  "message": "MFA challenge has expired",
  "code": "UNAUTHORIZED"
}
```
Description
Standard error response format
- errorstringrequired
  Example
  unauthorized
  Description
  Error type identifier:
  
  invalid_request: Malformed request or missing required fields
  
  unauthorized: Invalid credentials or token
  
  account_not_verified: Account exists but email/phone not verified
  
  session_expired: Maximum session lifetime exceeded, full re-login required
  
  unauthorized_tenant: User not authorized for requested tenant
  
  tenant_required: Multi-tenant user must specify tenant
  
  unauthorized_site: User not authorized for requested site
  
  site_required: Site context required for this operation
  
  no_authorized_sites: User has no authorized sites
  
  forbidden: Access denied (e.g., no authorized tenants)
  
  rate_limited: Too many requests, try again later
  
  account_locked: Account temporarily locked due to failed attempts
  
  internal_error: Server-side error
- messagestringrequired
  Example
  Invalid username or password
  Description
  Human-readable error description
- codestring<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>required
  Example
  UNAUTHORIZED
  Description
  HTTP status code name
  Allowed
  BAD_REQUESTUNAUTHORIZEDUNAUTHORIZED_TENANTTENANT_REQUIREDFORBIDDENRATE_LIMITEDACCOUNT_LOCKEDINTERNAL_SERVER_ERROR

500Internal server error

ErrorResponse
Description
Standard error response format
- errorstringrequired
  Example
  unauthorized
  Description
  Error type identifier:
  
  invalid_request: Malformed request or missing required fields
  
  unauthorized: Invalid credentials or token
  
  account_not_verified: Account exists but email/phone not verified
  
  session_expired: Maximum session lifetime exceeded, full re-login required
  
  unauthorized_tenant: User not authorized for requested tenant
  
  tenant_required: Multi-tenant user must specify tenant
  
  unauthorized_site: User not authorized for requested site
  
  site_required: Site context required for this operation
  
  no_authorized_sites: User has no authorized sites
  
  forbidden: Access denied (e.g., no authorized tenants)
  
  rate_limited: Too many requests, try again later
  
  account_locked: Account temporarily locked due to failed attempts
  
  internal_error: Server-side error
- messagestringrequired
  Example
  Invalid username or password
  Description
  Human-readable error description
- codestring<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>required
  Example
  UNAUTHORIZED
  Description
  HTTP status code name
  Allowed
  BAD_REQUESTUNAUTHORIZEDUNAUTHORIZED_TENANTTENANT_REQUIREDFORBIDDENRATE_LIMITEDACCOUNT_LOCKEDINTERNAL_SERVER_ERROR

curl

curl --request POST \
     --url https://api.upstartcommerce.com/api/v1/auth/mfa/resend \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '{
     "challengeId": "ch_abc123xyz"
     }'

javascript

var myHeaders = new Headers();
myHeaders.append("accept", "application/json");
myHeaders.append("content-type", "application/json");

var raw = JSON.stringify({
   "challengeId": "ch_abc123xyz"
});

var requestOptions = {
   method: 'POST',
   headers: myHeaders,
   body: raw,
   redirect: 'follow'
};

fetch("https://api.upstartcommerce.com/api/v1/auth/mfa/resend", requestOptions)
   .then(response => response.text())
   .then(result => console.log(result))
   .catch(error => console.log('error', error));

ruby

require "uri"
require "json"
require "net/http"

url = URI("https://api.upstartcommerce.com/api/v1/auth/mfa/resend")

https = Net::HTTP.new(url.host, url.port)
https.use_ssl = true

request = Net::HTTP::Post.new(url)
request["accept"] = "application/json"
request["content-type"] = "application/json"
request.body = JSON.dump({
   "challengeId": "ch_abc123xyz"
})

response = https.request(request)
puts response.read_body

python

import requests
import json

url = "https://api.upstartcommerce.com/api/v1/auth/mfa/resend"

payload = json.dumps({
   "challengeId": "ch_abc123xyz"
})
headers = {
   'accept': 'application/json',
   'content-type': 'application/json'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

200

// OTP resent successfully
{
  "challengeId": "ch_abc123xyz",
  "method": "sms",
  "expiresIn": 300,
  "maskedPhoneNumber": "***1234"
}

400

// Invalid request or not SMS MFA
{
  "error": "unauthorized",
  "message": "Invalid username or password",
  "code": "UNAUTHORIZED"
}

401

// Challenge expired
{
  "error": "unauthorized",
  "message": "Invalid username or password",
  "code": "UNAUTHORIZED"
}

500

// Internal server error
{
  "error": "unauthorized",
  "message": "Invalid username or password",
  "code": "UNAUTHORIZED"
}

GENERATED

// Internal server error
{
  "error": "unauthorized",
  "message": "Invalid username or password",
  "code": "UNAUTHORIZED"
}

tokenGenerationFailed

// Token generation failed
{
  "error": "internal_error",
  "message": "Token generation failed",
  "code": "INTERNAL_SERVER_ERROR"
}

serviceError

// Upstream service error
{
  "error": "internal_error",
  "message": "Failed to communicate with authentication backend",
  "code": "INTERNAL_SERVER_ERROR"
}