Confirm a phone number change for the current identity
PATCH
/current-identity-phone
Completes the phone number change flow started by POST /current-identity-phone. Consumes the single-use, 6-digit phone-change-otp code that was sent by SMS to the requested new phone number and, on success, promotes that number from pending_auth_id to the identity's active, verified phone auth method.The identity is taken from the authenticated session (identity_id), not the request body. The identity must already have a phone auth method with a pending change in progress (i.e. a prior successful call to POST /current-identity-phone) — attempting to confirm without one fails with a 404.Failed confirmation attempts are tracked per auth method. After 5 failed attempts within a 15-minute rolling window (both configurable via AUTH_MAX_CODE_ATTEMPTS / AUTH_CODE_LOCK_WINDOW_MS), further attempts are rejected with a 429 even if a subsequent code would have been correct — request a new code via POST /current-identity-phone to reset the flow. The code itself is single-use and time-limited; once consumed or expired it cannot be reused.Requires a JWT bearer token.
Request
Authorization
JWT Bearer
Add the parameter
Authorization
to Headers
Example:
Authorization: ********************
or
Body Params application/jsonRequired
Examples
Responses
🟢200
application/json
The code was valid and unused. The identity's phone auth method has been updated to the new, now-verified phone number.