Adapt the current deprecated endpoint to support push-notification
POST /accounts/public https://staging-subscribe.linphone.org/api#post-accountspublic
Edited based on the feedbacks by @SylvainBerfini
Restrict the endpoint by adding an account_creation_token parameter to authorize the call, return 403 otherwise
/!\ This might break the current SDK pipeline The SDK expect this endpoint to be fully public
GET /accounts/{phone}/info-by-phone https://staging-subscribe.linphone.org/api#get-accountsphoneinfo-by-phone
Keep the endpoint as deprecated but add a 'phone' => true on the object returned to know if it was resolved using a phone number (alias) or username.
POST /accounts/recover-by-phone https://staging-subscribe.linphone.org/api#post-accountsrecover-by-phone
Restrict the endpoint by adding an account_creation_token parameter to authorize the call, return 403 otherwise
/!\ This might break the current SDK pipeline The SDK expect this endpoint to be fully public
GET /accounts/{sip}/recover/{pin_code} https://staging-subscribe.linphone.org/api#get-accountssiprecoverrecoverkey
CHANGE: {sip}is resolving both the username AND the alias like for recover-by-phone.
Should be replaced by https://flexiphp.bla/api#post-accountssipactivatephone in the future.
About
All those changes will be merged in the 1.3 and master (1.4) branches. Before being released, the 1.4 branch will remove all those changed insecure endpoints.