---
title: "Request Password Reset"
method: POST
path: "/api/auth/request-reset"
tags: ["auth"]
---

# Request Password Reset

`POST /api/auth/request-reset`

## Request

- Base URL: `https://api.stellara.natlex.it` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stellara.natlex.it/api/auth/request-reset`
- Auth: none declared

Request a password reset code. Always returns 200 to avoid email enumeration.

Privacy invariants:
- Same response for known + unknown emails (timing differences are
  noise; we don't sleep to equalize because that's both ineffective
  against patient attackers and bad UX for legit users).
- Same response when the email send fails (SMTP down, bad creds,
  unverified alias, network blip). The privacy-preserving "If this
  email is registered..." message must NEVER hint at delivery success.

## Request body

- RequestPasswordResetRequest
  - `email` string, email, required

## Response `200`

Successful Response

- MessageResponse
  - `message` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/natlex/apis/stellara-api.md) · [All operations](https://skmtc.dev/natlex/apis/stellara-api/llms.txt) · [OpenAPI document](https://skmtc.dev/natlex/apis/stellara-api/revisions/e576f046b61f?raw)