---
title: "Check Password Reset Token"
method: GET
path: "/v1/auth/password-reset/{token}"
tags: ["auth", "auth"]
---

# Check Password Reset Token

`GET /v1/auth/password-reset/{token}`

## Request

- Base URL: `https://api.elaan.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.elaan.io/v1/auth/password-reset/{token}`
- Auth: none declared

Is this reset link still usable? Lets the console say "this link expired"
before the user types a new password, rather than after. Returns only a
boolean — an unknown token and an expired one are indistinguishable, so this
reveals nothing an attacker holding the token doesn't already have.

## Path parameters

- `token` string, required

## Response `200`

Successful Response

- PasswordResetTokenStatusResponse: Whether a reset link is still usable, so the console can say so before the user types a new password. Deliberately carries nothing about the account: an unknown token and an expired one look identical.
  - `valid` boolean, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/elaan/apis/elaan-api.md) · [All operations](https://skmtc.dev/elaan/apis/elaan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaan/apis/elaan-api/revisions/c96a7e6399aa?raw)