# Change the own phone password

> How the own access proves itself on the phone to manitu's support - with a session only.

- Effect: Write - Changes the account. Agents ask first.
- Idempotent: no
- Stability: beta
- REST: `POST https://api.manitu.de/v1/access/phonepassword/set`
- Page: /reference/access/phonepassword/set/

**Changes the account. Agents say what will happen and wait for an explicit yes before calling it.**

## REST

`POST https://api.manitu.de/v1/access/phonepassword/set`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

- `type` (string, required) - none: no phone password; fixed: phone_password; oath-totp: a code from an authenticator app - the secret is made by the server and answered once. (one of `"none"`, `"fixed"`, `"oath-totp"`)
- `phone_password` (string, write-only) - For fixed only: the phone password, printable ASCII. Kept as a hash only. (minLength `6`; maxLength `72`; pattern `"^[\\x21-\\x7E]([\\x20-\\x7E]*[\\x21-\\x7E])?$"`)

### Response

In `data`; the rest of the body as on every call.

- `account_user_id` (integer, required)
- `phone_password_type` (string, required) - (one of `"none"`, `"fixed"`, `"oath-totp"`)
- `totp` (object | null, required) - For oath-totp: what the authenticator app needs; null otherwise.
  - `totp.secret` (string, required) - The secret (base32) - shown this once.
  - `totp.uri` (string, required) - otpauth:// URI for a QR code - shown this once.

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/access/phonepassword/set' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"type":"none"}'
```

## Example result

```json
{
  "account_user_id": 12345,
  "phone_password_type": "none",
  "totp": {
    "secret": "string",
    "uri": "string"
  }
}
```