# Generate one-time password

The /api/customers/generateonetimepassword/ endpoint generates a one-time password for a customer. A one-time password can be used instead of a password when authenticating the customer. It can only be used for authentication once and only within 20 minutes after being generated.

# Parameters

• id string required
  ID of the customer to generate a one-time password for.
• send bool Defaults to true
  The one-time password is emailed to the customer by default. Set this to false to get the password back without sending an email.
• business_entity string
  External ID of the business entity inside Iteras to send the email from. Required when an email is sent, which is the default.
• exclude_from_webhooks bool Defaults to false
  Set to true to keep every event the request causes from being sent to webhooks, invoice and payment events included, e.g. "exclude_from_webhooks": true. The events are still added to the history.

If a one-time password has been requested for the customer too many times within a time limit no new one-time password is generated and an error is returned.

# Examples

Generate a one-time password and email it to the customer:

POST /api/customers/generateonetimepassword/ HTTP/1.1
Content-Type: application/json{
  "id": "12345",
  "business_entity": "DKbranch"
}

Generate a one-time password without sending an email:

POST /api/customers/generateonetimepassword/ HTTP/1.1
Content-Type: application/json

{
  "id": "12345",
  "send": false
}

# Return value

On success the endpoint returns the one-time password:

{ "onetime_password": "762195" }

# Errors

Invalid requests due to programming error, e.g. invalid JSON, returns 400. This also covers sending an email without a business_entity, which includes leaving out send.

A well-formed operation where a supplied value is invalid is not executed and returns an HTTP 422 error. Errors that are not specific to a field are returned with the empty string as key:

{
  "": ["Too many attempts generating one-time password"]
}

This also covers an unknown business_entity.