Auth

Reset password using the emailed code

On success, revokes the caller's current JWT and all refresh tokens (the user must log in again). All failure modes collapse into the same generic 400 (anti-enumeration); repeated failures lock out the reset code after 5 attempts.

post/auth/reset-password

Request

  • Base URL: http://localhost:38200
  • URL: http://localhost:38200/auth/reset-password
  • Auth: none required

Request body

emailstring email required
codestring required
passwordstring required

NIST SP 800-63B Rev.4 split floor, resolved server-side per account: 8 chars if the target account has a CONFIRMED user_mfa row, 15 otherwise. The 8 here is only the structural floor shared with the MFA-enrolled branch — a password-only account is rejected with password_too_short below 15 chars even though this schema accepts 8. Also checked against the HIBP breached-password corpus (fails open on an HIBP outage).

Response

Password reset. Session cookies cleared.

messagestring

Changes

No recorded changes to this operation across all 1 revision of this API.