---
title: "Issue an OTP for the password reminder flow"
method: POST
path: "/v1/password_reminder/challenge"
tags: ["Password Reminder"]
---

# Issue an OTP for the password reminder flow

`POST /v1/password_reminder/challenge`

## Request

- Base URL: `https://identity-api.paymongo.com`
- URL: `https://identity-api.paymongo.com/v1/password_reminder/challenge`
- Auth: none required

Unauthenticated. Validates email + current password (which must already be expired), optionally validates a candidate new password, and issues an email OTP. When `new_password` is empty the response is bound to the waive branch; when populated, to the update branch. Returns 201 with `data.type = "challenge"` carrying `expiration_at`/`resend_at`/`factor`.

## Request body

- UserPasswordReminderChallengeRequestEnvelopeDTO
  - `data` object
    - `attributes` UserPasswordReminderChallengeRequestDTO
      - `email` string, required
      - `factor` 'email' | 'sms': Issue leg only: nothing to send for an authenticator app, so "totp" is rejected by the delivery allow-list and belongs on the calls that submit a code.
      - `new_password` string
      - `new_password_confirmation` string
      - `password` string, required

## Response `201`

Created

- object: Standard response containing data and its metadata if any
  - `data` object
    - `attributes` UserPasswordReminderChallengeAttributesDTO
      - `expiration_at` integer
      - `factor` string
      - `resend_at` integer
    - `id` string
    - `type` string
  - `has_more` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `410`: Gone
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error
- `502`: Bad Gateway

---

[API](https://skmtc.dev/paymongo/apis/identity.md) - [All operations](https://skmtc.dev/paymongo/apis/identity/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/identity/revisions/cc3056164874?raw)