Problem description
In order to comply with ICM rule this API could be accessed via 3-legs flow.
As such, in this case the accessToken could be used to identify the device.
Consequently we should shift the phoneNumber in the request to optional & add the defined 422 errors:

• PHONE_NUMBER_NOT_ALLOWED
• MISSING_IDENTIFIER

Expected behavior
Remove phoneNumber from required field

Alternative solution

Additional context
This is is not a breaking change.