ReferenceHTTP APIAuth
Set a new password with a one-time reset link
POST
Spends the token, sets the password, revokes every live web session of the user and writes a reset_password receipt. There is no failure window: the token cannot be guessed, and a shared one would let anyone lock recovery out. Password hashing shares login's concurrency limit, past which it answers 429.
Auth: public; no credential. Idempotency-Key: ignored.
application/json- body
token*stringLength
1 <= length <= 256password*stringLength
12 <= lengthSuccess
application/json- response
user_id*stringMatch
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$Format
uuidreceipt_id*stringMatch
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$Format
uuidcurl -X POST 'https://example.com/v1/auth/password-reset' \ -H 'Content-Type: application/json' \ -d '{ "token": "string", "password": "stringstring"}'Example Response
{ "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5", "receipt_id": "64d0a161-468e-472a-b00e-a06ee9ab7de7"}