Password
Session cookie for authentication
Session cookie in format sessionid=<value>.
May use site-specific cookie name (e.g., osessionid).
CSRF token for state-changing requests
Set to 'XMLHttpRequest' for AJAX requests to receive JSON response
New password
Confirm new password (must match password1).
Validated against AUTH_PASSWORD_VALIDATORS setting.
Password set successfully (AJAX request). Returns location URL for redirect.
URL to redirect (typically same endpoint)
/users/password/set/Password set successfully (non-AJAX request), redirects to location
Validation errors (AJAX request):
- Password mismatch (password1 != password2)
- Weak password (fails AUTH_PASSWORD_VALIDATORS)
POST /users/password/set/ HTTP/1.1
Host: sandbox.akinon.com
X-CSRFToken: text
Content-Type: application/json
Accept: */*
Content-Length: 47
{
"password1": "password",
"password2": "password"
}{
"location": "/users/password/set/"
}Session cookie for authentication
Session cookie in format sessionid=<value>.
May use site-specific cookie name (e.g., osessionid).
CSRF token for state-changing requests
New password
Confirm new password (must match password1)
Phone number for SMS verification
SMS verification code. Omit on first request to receive OTP.
Set to true to request a new verification code
falsePassword set successfully (Step 2 completed)
SMS verification code sent (Step 1 or resend). Confirmation data stored in session.
Returns submitted data (without code) or empty response.
Validation errors:
- Password mismatch (password1 != password2)
- Weak password (fails AUTH_PASSWORD_VALIDATORS)
- Phone already exists for another active user
- Phone format invalid
- Incorrect OTP code during verification
Authentication required (must be logged in)
Too many requests:
- Throttling limit exceeded (register scope)
- SMS resend interval not elapsed
POST /users/password-sms-otp/set/ HTTP/1.1
Host: sandbox.akinon.com
X-CSRFToken: text
Content-Type: application/json
Accept: */*
Content-Length: 91
{
"password1": "password",
"password2": "password",
"phone": "text",
"code": "text",
"resend": false
}{}Frontend identifier for multi-frontend setups.
Must be in VALID_FRONTEND_IDS setting (Dynamic Configuration).
Passed to email template context as frontend_id.
Email address for password reset link
Reset email sent if address exists. Response is identical for existing and non-existing emails to prevent enumeration.
Confirmation message
Too many reset requests
POST /users/password/reset/ HTTP/1.1
Host: sandbox.akinon.com
Content-Type: application/json
Accept: */*
Content-Length: 26
{
"email": "name@gmail.com"
}{
"detail": "text"
}Phone number for password reset SMS
Success response (always returned regardless of phone existence). SMS is sent only if phone belongs to an active user.
Confirmation message (translated)
If the phone number you specified is registered, a password reset sms has been sent.Validation errors:
- Phone format is invalid
Throttling limit exceeded (password-reset scope)
POST /users/password/reset-with-phone/ HTTP/1.1
Host: sandbox.akinon.com
Content-Type: application/json
Accept: */*
Content-Length: 16
{
"phone": "text"
}{
"success": "If the phone number you specified is registered, a password reset sms has been sent."
}Session cookie for authentication
Session cookie in format sessionid=<value>.
May use site-specific cookie name (e.g., osessionid).
CSRF token for state-changing requests
Current password
New password
Confirm new password (must match new_password1)
Password changed successfully
Success confirmation message (translated)
New password has been saved.Validation errors:
- Invalid old password ("Invalid password.")
- Password mismatch (new_password1 != new_password2)
- Weak password (fails AUTH_PASSWORD_VALIDATORS)
Authentication required
POST /users/password/change/ HTTP/1.1
Host: sandbox.akinon.com
X-CSRFToken: text
Content-Type: application/json
Accept: */*
Content-Length: 81
{
"old_password": "password",
"new_password1": "password",
"new_password2": "password"
}{
"detail": "New password has been saved."
}Phone number associated with the account. Must pass phone number format validation.
05355555555Verification code received via SMS in Step 1. Omit on first request to trigger SMS delivery. Include on second request to verify the code.
123456Set to true to request a new verification code.
falseOTP verified successfully (AJAX/API request). Returns redirect URL to the password reset confirmation page.
Verification code sent or resent successfully. Also returned when the phone number is not found (identical response to prevent enumeration).
No content
OTP verified successfully (browser request). Redirects to the password reset confirmation page.
Phone number format is invalid.
OTP verification failed. The response includes a machine-readable
error_code and a human-readable non_field_errors message.
Error codes:
sms_verification_100_1: Phone number does not match the session recordsms_verification_100_2: Verification code is incorrectsms_verification_100_3: SMS resend interval has not elapsed yetsms_verification_100_4: Verification code has expired
Throttling limit exceeded (password-reset scope).
POST /users/password/reset-with-sms-otp/ HTTP/1.1
Host: sandbox.akinon.com
Content-Type: application/json
Accept: */*
Content-Length: 54
{
"phone": "05355555555",
"code": "123456",
"resend": false
}No content
Last updated
Was this helpful?