Recover user identity (single authN ID)

This is the standard use case delivered by the Recover ID Process. In this scenario, the end user only has one registered authentication identifier (authN ID). An anonymous end user selects to recover their identity using a registered authN ID (email or mobile). The end user only has one registered and verified authN ID, so they won’t be prompted to select a destination.

Initial Request

Your client calls the Process Start API to initialize the Process:

**POST https://\{your.url\}/process/start/recovery.PasswordRecovery.v1.0**
<no body>

Response

Storefront Gateway responds with a request to provide a registered (and verified) email or mobile:

**RESPONSE - body**
{
   "processId": "80d248a2-ec15-428f-be42-500426fabec9",
   "processName": "recovery.PasswordRecovery.v1.0",
   "displayMessage": "Please input required information",
   "parameters": {
      "authnIdentifier": "String"
   },
   "stepName": "UsernamePrompt",
   "lastStep": false
}

`processId`	Unique identifier for the current instance of this Process.
`processName`	Full name of the Process, including the category and version number.
`stepName`	Name of the specific step that the Process is currently on.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
`displayMessage`	Optional message that the UI can display to the end user.
`parameters`	Object that specifies the info this Process requires to continue its task.
`authnIdentifier`	One of the user’s available Authentication Identifiers, used to identify the Storefront Gateway profile.

Next Request: User’s AuthN ID

Your client calls the Process Step API, and passes the user-supplied authN ID to the Process:

**PUT https://\{your.url\}/process/step**
{
   "processId": "80d248a2-ec15-428f-be42-500426fabec9",
   "parameters": {
       "authnIdentifier": "bob@example.com"
   }
}

`processId`	Unique identifier for the current instance of this Process.
`parameters`	Object that contains the data that was requested in the previous Process response.
`authnIdentifier`	One of the user’s available Authentication Identifiers, used to identify the Storefront Gateway profile.

Process Complete

The end user only has one authN ID, so Storefront Gateway delivers a notification to that email/mobile with either a clickable redirect URL or a short One-time Passcode (or both) which can be used to complete the recovery. The Process ends, and returns a 200 HTTP status:

**RESPONSE - body**
{
   "processId": "80d248a2-ec15-428f-be42-500426fabec9",
   "processName": "recovery.PasswordRecovery.v1.0",
   "lastStep": true,
   "output": {
      "pkat": "7c72281e-deb1-430c-be59-f3e0af71174d",
      "selectedRecoveryOptionType": "EMAIL",
      "selectedRecoveryOption": "b**@example.com"
   }
}

OTP Verification & Resend Verification Any Process step that sends a Storefront Gateway action token to a user also returns a corresponding PKAT to the client web application. In order to enable OTP verification on the UI, the client must retain the PKAT returned by the final Process step. The PKAT, along with the user-supplied OTP, is required for the GET[/session/token?customToken=\{OTP\}&pkat=\{pkat\}](c_sessionToken) API to invoke the subsequent Activate User Process to complete the user onboarding. In cases where the user is anonymous, the PKAT is required if the application wants to provide a quick token resend option on the UI, using the [PUT /session/token?pkat=\{pkat\}](c_putSessionToken) API. This method applies to cases where the user is anonymous (i.e., they are not authenticated in Storefront Gateway). However, if the user is currently authenticated in Storefront Gateway, the client application can instead invoke the Resend Verification Process for this purpose.

`processId`	Unique identifier for the current instance of this Process.
`processName`	Full name of the Process, including the category and version number.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
`output`	Object that contains data that the client can consume, retain, and use for additional operations.
`pkat`	Unique Proof Key for Action Token that corresponds to an existing action token. See Action Tokens for more details.
`selectedRecoveryOptionType`	Identifies the method (email or SMS) in which a recovery message was generated and delivered to.
`selectedRecoveryOption`	Identifies the e-mail address or phone number in which a recovery message was generated and delivered to. Sensitive data (email address / mobile number) is masked out for security concerns.
Note: Even if an invalid authN ID is supplied to the Process (no matching user exists within Storefront Gateway), the Process will respond as if a notification has been sent. This is a security measure to prevent malicious actors from brute-force attempts to read responses and determine valid authN IDs. Storefront Gateway will not try to deliver notifications to users who do not exist. Instead, the Process silently fails.

Parent topic:Recover ID & Reset Password Processes

Home

Introduction

For Merchants

For Resellers

Partner Ecosystem Management

Commerce Engine

Storefront Experience

APIs

Initial Request

Response

Next Request: User’s AuthN ID

Process Complete

​Initial Request

​Response

​Next Request: User’s AuthN ID

​Process Complete

Initial Request

Response

Next Request: User’s AuthN ID

Process Complete