Change the own phone password

How the own access proves itself on the phone to manitu's support - with a session only.

WWriteNot idempotentbeta

POST

/v1/access/phonepassword/seton https://api.manitu.de

Try it

Changes the account. Agents say what will happen and wait for an explicit yes before calling it.

Not offered over MCP - only to programs over REST.

Authentication

One of X-API-Key, Authorization: Bearer … - never more than one in a request. More

Request body JSON; unknown fields are refused

typestringrequired

none: no phone password; fixed: phone_password; oath-totp: a code from an authenticator app - the secret is made by the server and answered once.

One of none fixed oath-totp

phone_passwordstringwrite-only

For fixed only: the phone password, printable ASCII. Kept as a hash only.

min length 6max length 72pattern ^[\x21-\x7E]([\x20-\x7E]*[\x21-\x7E])?$

Response in `data`; the rest of the body as on every call

account_user_idintegerrequired

phone_password_typestringrequired

One of none fixed oath-totp

totpobject | nullrequired

For oath-totp: what the authenticator app needs; null otherwise.

totp.secretstringrequired

The secret (base32) - shown this once.

totp.uristringrequired

otpauth:// URI for a QR code - shown this once.

Statuses

200Success.400The request does not match the declared input schema.401No credential was presented, or it was not recognised.403The credential is not permitted to use this operation.500The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.503The channel this operation forwards through is unavailable.

POST/v1/access/phonepassword/set

Request

curl -X POST 'https://api.manitu.de/v1/access/phonepassword/set' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "none"
  }'

const response = await fetch('https://api.manitu.de/v1/access/phonepassword/set', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "type": "none"
  }),
});
const answer = await response.json();

<?php

$curl = curl_init('https://api.manitu.de/v1/access/phonepassword/set');

curl_setopt_array($curl, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => [
        'X-API-Key: ' . getenv('API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => '{"type":"none"}',
    CURLOPT_RETURNTRANSFER => true,
]);

$answer = json_decode(curl_exec($curl), true);

import os

import requests

response = requests.request(
    "POST",
    "https://api.manitu.de/v1/access/phonepassword/set",
    headers={"X-API-Key": os.environ["API_KEY"]},
    json={
        "type": "none",
    },
)
answer = response.json()

Response 200

{
  "status": {
    "type": "success",
    "code": 200
  },
  "meta": {},
  "data": {
    "account_user_id": 12345,
    "phone_password_type": "none",
    "totp": {
      "secret": "string",
      "uri": "string"
    }
  }
}

Change the own phone password

Authentication

Request body JSON; unknown fields are refused

Response in data; the rest of the body as on every call

Statuses

Response in `data`; the rest of the body as on every call