---
title: "Confirm a password reset"
method: POST
path: "/auth/password/reset/confirm"
---

# Confirm a password reset

`POST /auth/password/reset/confirm`

## Request

- Base URL: `https://api.caveman.so/api/v1`
- URL: `https://api.caveman.so/api/v1/auth/password/reset/confirm`
- Auth: none required

POST /api/v1/auth/password/reset/confirm on the Caveman Cloud control plane. Unauthenticated but rate-limited; it establishes or ends a session rather than reading tenant data. Not exposed to autonomous agents: Not RBAC-guarded — part of the authentication or webhook plane. Agents authenticate through a scoped control-plane session and never touch these directly.

## Request body

- object
  - `token` string, required
  - `new_password` string, required

## Response `200`

Password reset and existing sessions revoked

## Other responses

- `400`: Weak password or invalid, expired, or consumed token
- `429`: Rate limited
- `2XX`: Successful response. Exact status depends on synchronous or durable delivery outcome.
- `4XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `5XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.

---

[API](https://skmtc.dev/caveman/apis/caveman-cloud-api.md) - [All operations](https://skmtc.dev/caveman/apis/caveman-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/caveman/apis/caveman-cloud-api/revisions/508312d01cfc?raw)