Repository navigation
Conversation
Storefront Customer: request-creation-code documents the 422 for an existing account or an unusable number, the sixty-second resend window, ten-minute single-use codes, the five-a-minute throttle and the 429/423 refusals; login-with-sms documents the method field and the email fallback; the verify endpoints document the five-guess code lock and the per-identity 429 lockout; phone verification and account closure follow the same rules. Response examples added for request-creation-code (200, 422, 429) and login-with-sms (sms and email). Fleetbase API Customers and Drivers: the creation-code request no longer seeds a pending user record; login SMS, forgot-password and the verify and reset endpoints document single-use codes, the five-guess lock, the throttle and the email fallback.
This was referenced Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the spec in line with the SMS guard shipped across core-api, storefront and fleetops after the storefront SMS-pumping incident. Descriptions and params only, plus response examples where the reference had none.
Storefront API → Customer
request-creation-code:422for an existing account or an invalid / untextable number; a repeat inside sixty seconds answersokwithout a second message; ten-minute single-use codes; five requests a minute per key and address;429+Retry-Afterand423refusals. Examples added: 200, 422, 429.login-with-sms: themethodfield and the email fallback (also when the guard refuses). Examples added:smsandemail.verify-code,verify-phone-number,confirm-account-closure: codes verify once, lock after five wrong guesses, and the identity is locked out with429after ten wrong codes in fifteen minutes.request-phone-verification,account-closure: validation, throttle and refusal statuses; closure falls back to email when the text cannot go.Fleetbase API → Customers / Drivers
Request Customer Creation Code: no pending user record is created any more;name/phoneparams reworded to match.methodfield and email fallback. A guard refusal now reaches the caller as422/429+Retry-After/423(feat(auth): hashed single-use verification codes, no stub users before verification fleetops#395), with the email fallback kept on the login endpoints.Not in scope: the admin
int/v1/sms-guard/*routes are console-internal and the Core API collection does not coverint/v1.Related
Source changes: fleetbase/core-api#305, fleetbase/core-api#307, fleetbase/storefront#144, fleetbase/storefront#145, fleetbase/fleetops#393, fleetbase/fleetops#395. Prose docs: fleetbase/fleetbase.io#128.
Type of Change
Validation
npm run postman:lintCollections were not run: the changes are descriptions, params and static examples, and exercising them for real would send text messages.
Documentation Impact
fleetbase/fleetbase.io(fleetbase/fleetbase.io#128)API Reference Impact
fleetbase/postmanAPI reference notes: the generated reference picks these up through the usual
bump-postmanworkflow once this merges.Risk
None; no request URLs, methods or variables change.