auth

Confirm password reset with token and new password.

Validates the reset token, updates the password (argon2id), bumps password_changed_at to invalidate all existing JWT sessions (ADR-047), and revokes all active API keys of the tenant (STRIDE E1). Token is single-use and expires in 60 minutes.

post/v1/auth/password-reset/confirm

Request

  • Base URL: https://api.andish.ru (the document declares no server; this is the origin it was published from)
  • URL: https://api.andish.ru/v1/auth/password-reset/confirm
  • Auth: none declared

Request body

tokenstring required

Plaintext reset token received via email link. Sent in POST body only.

new_passwordstring required

New password. Min 10 chars, max 128 (ADR-019 §7). No composition requirements. Hashed with argon2id before storage.

Response

Password reset successfully

messagestring

Confirmation that the password was changed.

Changes

No recorded changes to this operation across all 1 revision of this API.