---
title: "Forgot Password"
method: POST
path: "/api/v1/auth/forgot-password"
tags: ["auth-flows"]
---

# Forgot Password

`POST /api/v1/auth/forgot-password`

## Request

- Base URL: `https://api.gnosari.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gnosari.com/api/v1/auth/forgot-password`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-AUTH-TOKEN`

Request a password reset. ALWAYS returns 200 with a fixed body.

Rate-limited per client IP via the reused ``AuthService`` limiter (raises
``LoginRateLimitError`` -> 429). For a real user this mints a reset token
and emits ``user.password_reset_requested``; for an unknown email it is a
silent no-op -- the response is byte-identical either way.

## Request body

- ForgotPasswordRequest: Body for ``POST /auth/forgot-password``.
  - `email` string, email, required

## Response `200`

Successful Response

- FlowMessageResponse: Uniform, side-effect-free success envelope for the identity flows.
  - `message` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/gnosari/apis/gnosari-api.md) · [All operations](https://skmtc.dev/gnosari/apis/gnosari-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gnosari/apis/gnosari-api/revisions/f299cf53ae5f?raw)