# Start reset by SMS OTP

Starts a password reset flow by sending an SMS OTP. **Required permissions**: `apps:execute`, `[appId]:execute`, `auth:execute`.

Endpoint: POST /v1/auth/password/reset/sms/otp
Security: ClientAccessToken

## Security:

  - `ClientAccessToken` (unknown)
    oauth2

## Request fields (application/json):

  - `prev_reset_token` (string)
    Reset token that contains `mfa_required` as `true`. Should be passed when initiating a second factor authentication, in case MFA is required for password reset flows.

  - `ignore_mfa` (boolean)
    Allows resetting the password without MFA in case MFA is required for password reset flows

  - `phone_number` (string, required)
    Phone number to send the SMS to, specified in E.164 format
    Example: +16175551212

## Response 200 fields (application/json):

  - `message` (string, required)
    Example: SMS Sent

## Response 403:

  - `403` (unknown)
    When the phone number of the user is not verified, a forbidden error will be returned

## Response 403 fields (application/json):

  - `error_code` (string)
    Enum: "system_forbidden", "auth_password_invalid_reset_token"

  - `message` (string)

## Response 404:

  - `404` (unknown)
    When there is no user with the requested phone number as primary phone number in the tenant

## Response 404 fields (application/json):

  - `error_code` (string)
    Enum: "app_not_exist", "user_phone_number_missing"

  - `message` (string)

## Response 503:

  - `503` (unknown)
    Error occurred while sending SMS

## Response 503 fields (application/json):

  - `error_code` (string)
    Enum: "system_service_unavailable"

  - `message` (string)