Identity

What the platform knows about a phone number or an email address that has been sent a one-time code: whether it is verified, whether the outstanding code has expired, how many attempts have failed, and the code itself.

A record is keyed by the contact detail. It exists before any customer does, a code is sent to a phone number, and only later does that number belong to somebody. So this is not a view of a customer, and there is no cust_ to read it by.

The read includes the live code. Anyone holding it can pass the verification, which is why this whole collection is platform administrators only.

Resetting clears the failed attempts and issues a new code. That is what to do for someone locked out by failed attempts, or whose code never arrived.