---
title: "Confirm password reset with token and new password."
method: POST
path: "/v1/auth/password-reset/confirm"
tags: ["auth"]
---

# Confirm password reset with token and new password.

`POST /v1/auth/password-reset/confirm`

## Request

- Base URL: `https://api.andish.ru` (the document declares no server; this is the origin it was published from)
- URL: `https://api.andish.ru/v1/auth/password-reset/confirm`
- Auth: none declared

Validates the reset token, updates the password (argon2id), bumps password_changed_at to invalidate all existing JWT sessions (ADR-047), and revokes all active API keys of the tenant (STRIDE E1). Token is single-use and expires in 60 minutes.

## Request body

- PasswordResetConfirmRequest: Request body for POST /v1/auth/password-reset/confirm. AC #8: password policy ADR-019 §7 — min 10, max 128, no composition rules. I1 (STRIDE): token only in POST body, never in path or query params.
  - `token` string, required: Plaintext reset token received via email link. Sent in POST body only.
  - `new_password` string, required: New password. Min 10 chars, max 128 (ADR-019 §7). No composition requirements. Hashed with argon2id before storage.

## Response `200`

Password reset successfully

- PasswordResetConfirmResponse: Response for successful POST /v1/auth/password-reset/confirm (HTTP 200).
  - `message` string: Confirmation that the password was changed.

## Other responses

- `400`: Token expired, used, or invalid
- `422`: Password too weak or token missing/too long
- `429`: Rate limit exceeded

---

[API](https://skmtc.dev/andish/apis/mnemo-api.md) · [All operations](https://skmtc.dev/andish/apis/mnemo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/andish/apis/mnemo-api/revisions/d5449f23414c?raw)