---
title: "Reset password using the emailed code"
method: POST
path: "/auth/reset-password"
tags: ["Auth"]
---

# Reset password using the emailed code

`POST /auth/reset-password`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/auth/reset-password`
- Auth: none required

On success, revokes the caller's current JWT and all refresh tokens (the user must log in again). All failure modes collapse into the same generic 400 (anti-enumeration); repeated failures lock out the reset code after 5 attempts.

## Request body

- object
  - `email` string, email, required
  - `code` string, required
  - `password` string, required: NIST SP 800-63B Rev.4 split floor, resolved server-side per account: 8 chars if the target account has a CONFIRMED `user_mfa` row, 15 otherwise. The 8 here is only the structural floor shared with the MFA-enrolled branch — a password-only account is rejected with `password_too_short` below 15 chars even though this schema accepts 8. Also checked against the HIBP breached-password corpus (fails open on an HIBP outage).

## Response `200`

Password reset. Session cookies cleared.

- object
  - `message` string

## Other responses

- `400`: Validation failure, or invalid/expired reset code (generic message, anti-enumeration).
- `429`: Rate limit exceeded for this endpoint.

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)