diff --git a/app/Config/RateLimiter.php b/app/Config/RateLimiter.php
index 99d8b60..168aa6f 100644
--- a/app/Config/RateLimiter.php
+++ b/app/Config/RateLimiter.php
@@ -35,7 +35,7 @@ class RateLimiter extends BaseConfig
     |--------------------------------------------------------------------------
     */
     public array $userBlock = [
-        'soft_duration'   => 0,        // permanent, manual unblock only
+        'soft_duration'   => 900,        // permanent, manual unblock only
         'medium_duration' => 7200,     // 2 hours
         'hard_duration'   => 86400,    // 24 hours
         // attempts while at a block level before escalating to next
diff --git a/app/Controllers/RestAuthenticationController.php b/app/Controllers/RestAuthenticationController.php
index 4573bbf..02bf50f 100755
--- a/app/Controllers/RestAuthenticationController.php
+++ b/app/Controllers/RestAuthenticationController.php
@@ -685,6 +685,7 @@ class RestAuthenticationController extends AdminController
 
             $data = $this->request->getJSON();
 
+
             $email = $data->email;
            
             $HrData = $this->hrModel->where('email', $email)
@@ -702,6 +703,8 @@ class RestAuthenticationController extends AdminController
                 $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Sending default otp");
             }
 
+            $data->otp = $otp; 
+
             if ($HrData) {
 
                 //check the resend otp (with in 60 seconds don't allow another otp to send)
@@ -870,6 +873,7 @@ class RestAuthenticationController extends AdminController
 
                     // Call the third-party API function
                     $apiResponse = $this->callThirdPartyAPI($this->request->getJSON(),'getVerifiedHrData');
+                     recordRateLimitFailure();
                     return $this->respond(['status' => 'failed','code' => 404,'data' => "" , 'post_enrollment'=> json_decode($apiResponse, true)],200);
                 }
 
@@ -878,6 +882,7 @@ class RestAuthenticationController extends AdminController
 
                 // Call the third-party API function
                 $apiResponse = $this->callThirdPartyAPI($this->request->getJSON(),'getVerifiedHrData');
+                 recordRateLimitFailure();
                 return $this->respond(['status' => 'failed','code' => 404,'data' => "" , 'post_enrollment'=> json_decode($apiResponse, true)],200);
             }
         } catch (\Exception $e) {
diff --git a/app/Helpers/utility_helper.php b/app/Helpers/utility_helper.php
index bac046f..b07a22c 100755
--- a/app/Helpers/utility_helper.php
+++ b/app/Helpers/utility_helper.php
@@ -877,6 +877,7 @@ function generateFingerprint(bool $exclude_ua = false): string
 
         // Record user-level failure
         if (!empty($identity)) {
+            log_message('error','user block called in recordRateLimitFailure with' .$identity.' - '. $context );
             $limiter->recordUserFailure($identity, $context);
         }
     }
\ No newline at end of file