customer.request_otp

Request a passwordless login code by email. Anonymous, store-scoped; rate-limited per email.

• Scope: public
• System: no
• Reachable from: an ANONYMOUS face — no credential, and never /v1/commands/*. Which path serves it is not derivable from the registry; see the anonymous faces.
• Events: none — It starts an authentication handshake — it publishes no fact about the customer, and the code it mints is a secret nothing downstream may see. customer.registered is where identity actually begins.

Input (JSON Schema)

{
  "properties": {
    "client_ip": {
      "type": "string"
    },
    "email": {
      "format": "email",
      "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$",
      "type": "string"
    }
  },
  "required": [
    "email"
  ],
  "type": "object"
}

Result (200)

{
  "additionalProperties": false,
  "properties": {
    "requested": {
      "const": true,
      "type": "boolean"
    }
  },
  "required": [
    "requested"
  ],
  "type": "object"
}

Errors

validation_failed (400) · unauthorized (401) · forbidden (403) · conflict (409) · internal (500)