> ## Documentation Index > Fetch the complete documentation index at: https://docs.lobbystack.com/llms.txt > Use this file to discover all available pages before exploring further. # Set or remove keypad PINs > Sets the keypad PIN each contact types to change appointments by phone when verification_mode is passcode_required, or removes it with null. A new PIN also unlocks a locked one. Send up to 20 contacts, each once: if any isn't this business's, nothing changes. Returns the contacts in the order sent. LobbyStack keeps only a hash of each PIN, and this endpoint ignores Idempotency-Key so it never stores a copy. As in the dashboard, only owners and admins set PINs: a per-business key whose creator no longer is one gets a 403 key_owner_inactive. ## OpenAPI ````yaml /api-reference/openapi.json post /contacts/passcodes openapi: 3.1.0 info: title: LobbyStack API version: v1 description: >- Read calls, contacts, appointments and messages, book appointments, and subscribe to webhooks. Authenticate with an API key in the Authorization header. A platform key also names the business it acts on in the LobbyStack-Business header. Each key allows 120 requests per minute by default. servers: - url: https://app.lobbystack.com/api/v1 security: - bearerAuth: [] tags: - name: Business - name: Receptionist - name: Billing - name: Phone numbers - name: Onboarding - name: Team - name: Website chat - name: Calendars - name: Notifications - name: Calls - name: Contacts - name: Appointments - name: Messages - name: Knowledge - name: Webhooks - name: Platform paths: /contacts/passcodes: post: tags: - Contacts summary: Set or remove keypad PINs description: >- Sets the keypad PIN each contact types to change appointments by phone when verification_mode is passcode_required, or removes it with null. A new PIN also unlocks a locked one. Send up to 20 contacts, each once: if any isn't this business's, nothing changes. Returns the contacts in the order sent. LobbyStack keeps only a hash of each PIN, and this endpoint ignores Idempotency-Key so it never stores a copy. As in the dashboard, only owners and admins set PINs: a per-business key whose creator no longer is one gets a 403 key_owner_inactive. operationId: setContactPasscodes parameters: - name: LobbyStack-Business in: header description: >- The business a platform key acts on. Required with a platform key. A per-business key may leave it out; if it sends one, it must be the key's own business. schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ContactPasscodesUpdate' responses: '200': description: OK content: application/json: schema: type: object required: - data - next_cursor - has_more properties: data: type: array items: $ref: '#/components/schemas/Contact' next_cursor: type: - string - 'null' description: >- Pass as cursor to get the next page. Null on the last page. has_more: type: boolean '400': description: >- The request is invalid (invalid_request), or a platform key sent no LobbyStack-Business header (business_required). content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: The API key is missing, invalid, or revoked (unauthorized). content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Refused. insufficient_scope: the key lacks the contacts:write scope. forbidden: a per-business key named another business in LobbyStack-Business. key_owner_inactive: the person the key acts for can't any more: a per-business key's creator is no longer an owner or admin, or a platform key's owner_email has no verified LobbyStack account. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: A platform key named a business it cannot act on (not_found). content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: The request conflicts with the current state. content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Too many requests (rate_limited). Wait for the Retry-After header's number of seconds. content: application/json: schema: $ref: '#/components/schemas/Error' headers: Retry-After: schema: type: integer description: Seconds to wait. security: - bearerAuth: [] components: schemas: ContactPasscodesUpdate: type: object properties: passcodes: minItems: 1 maxItems: 20 type: array items: type: object properties: contact_id: type: string format: uuid description: Stable identifier (UUID). passcode: anyOf: - type: string pattern: ^\d{4,8}$ - type: 'null' description: >- The new PIN: 4 to 8 digits, not one digit repeated or digits in a row such as 1111 or 1234. null removes the contact's PIN. required: - contact_id - passcode additionalProperties: false description: >- Each item has a contact_id and its passcode: the new PIN, or null to remove the PIN. 1 to 20 contacts, each once. required: - passcodes additionalProperties: false Contact: type: object properties: id: type: string format: uuid description: Stable identifier (UUID). name: type: - string - 'null' phone: type: - string - 'null' email: type: - string - 'null' locale: type: - string - 'null' timezone: type: - string - 'null' passcode: anyOf: - type: object properties: set_at: type: string format: date-time description: ISO 8601 timestamp in UTC. locked: type: boolean description: >- true after 5 wrong PINs in a row, even across calls. A locked PIN works again only once a new one is set. required: - set_at - locked additionalProperties: false - type: 'null' description: >- The contact's keypad PIN, which callers type to change appointments when verification_mode is passcode_required: whether there is one, never the PIN itself. null: the contact has no PIN. created_at: type: string format: date-time description: ISO 8601 timestamp in UTC. updated_at: type: string format: date-time description: ISO 8601 timestamp in UTC. required: - id - name - phone - email - locale - timezone - passcode - created_at - updated_at additionalProperties: false Error: type: object properties: error: type: object properties: code: type: string enum: - invalid_request - unauthorized - forbidden - insufficient_scope - not_found - conflict - idempotency_key_reused - idempotency_request_in_progress - booking_disabled - booking_requires_confirmation - slot_unavailable - rate_limited - rate_limit_unavailable - method_not_allowed - internal_error - business_required - key_owner_inactive - plan_limit_reached message: type: string details: type: array items: type: object properties: path: type: string message: type: string required: - path - message additionalProperties: false required: - code - message additionalProperties: false required: - error additionalProperties: false securitySchemes: bearerAuth: type: http scheme: bearer description: >- An API key from Settings > API keys (lsk_...), which acts on its own business, or a platform key from the PLATFORM_API_KEYS setting (lsp_...), which onboards and manages businesses. Scopes: business:read, business:write, calls:read, contacts:read, contacts:write, appointments:read, appointments:write, messages:read, knowledge:read, knowledge:write, webhooks:manage, billing:manage, phone_numbers:manage, team:manage, businesses:create, users:create. Only platform keys can hold businesses:create and users:create. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.