auth

Request Password Reset

Request a password reset code. Always returns 200 to avoid email enumeration.

Privacy invariants:

  • Same response for known + unknown emails (timing differences are noise; we don't sleep to equalize because that's both ineffective against patient attackers and bad UX for legit users).
  • Same response when the email send fails (SMTP down, bad creds, unverified alias, network blip). The privacy-preserving "If this email is registered..." message must NEVER hint at delivery success.
post/api/auth/request-reset

Request

  • Base URL: https://api.stellara.natlex.it (the document declares no server; this is the origin it was published from)
  • URL: https://api.stellara.natlex.it/api/auth/request-reset
  • Auth: none declared

Request body

emailstring email required

Response

Successful Response

messagestring required

Changes

No recorded changes to this operation across all 1 revision of this API.