---
title: "Resend Reset"
method: POST
path: "/api/auth/resend-reset"
tags: ["auth", "billing"]
---

# Resend Reset

`POST /api/auth/resend-reset`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/auth/resend-reset`
- Auth: none declared

Resend the password-reset email for a given address.

CR-H9 (2026-04-30): users whose reset email was caught by spam
filters or bounced had no recovery path — the token expired after
1 hour with no way to trigger a new send. This endpoint generates
a fresh reset token (matching the /api/auth/forgot-password pattern)
and re-queues the email.

Security: always HTTP 200 + neutral message regardless of whether
the email exists (no user enumeration). Rate-limited 3/hr per IP
(middleware auth_resend bucket) + 3/hr per (IP, email) inline.

## Response `200`

Successful Response

- AuthResendResponse: `POST /api/auth/resend-reset` and `POST /api/auth/resend-verify` response. Always returns HTTP 200 with `success: True` and a neutral message, regardless of whether the email address exists in the database. This prevents user-enumeration: an attacker cannot distinguish "email not found" from "email found, mail queued". `success` is REQUIRED — it is the only field the frontend checks to decide whether to show a "check your inbox" confirmation or surface an error toast. `error` is Optional and only present when an unexpected server-side failure occurred that prevented even attempting the send (e.g. PG completely unavailable, email service misconfigured). `message` carries the user-visible text.
  - `success` boolean, required: Always True on HTTP 200 paths. Frontend shows 'check your inbox' confirmation on True; surfaces an error toast on False.
  - `message` string, nullable: User-visible neutral confirmation, e.g. 'If an account exists with this email, we have sent a link.'
  - `error` string, nullable: Machine-readable error tag. Only present on unexpected server failures (PG down, email service mis-config). NOT set for email-not-found (that still returns success=True).

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)