auth
billing

Resend Reset

Resend the password-reset email for a given address.

CR-H9 (2026-04-30): users whose reset email was caught by spam filters or bounced had no recovery path — the token expired after 1 hour with no way to trigger a new send. This endpoint generates a fresh reset token (matching the /api/auth/forgot-password pattern) and re-queues the email.

Security: always HTTP 200 + neutral message regardless of whether the email exists (no user enumeration). Rate-limited 3/hr per IP (middleware auth_resend bucket) + 3/hr per (IP, email) inline.

post/api/auth/resend-reset

Request

  • Base URL: https://www.oxfordledge.com (the document declares no server; this is the origin it was published from)
  • URL: https://www.oxfordledge.com/api/auth/resend-reset
  • Auth: none declared

Response

Successful Response

successboolean required

Always True on HTTP 200 paths. Frontend shows 'check your inbox' confirmation on True; surfaces an error toast on False.

messagestring nullable

User-visible neutral confirmation, e.g. 'If an account exists with this email, we have sent a link.'

errorstring nullable

Machine-readable error tag. Only present on unexpected server failures (PG down, email service mis-config). NOT set for email-not-found (that still returns success=True).

Changes

No recorded changes to this operation across all 1 revision of this API.