---
title: "Reset password"
method: POST
path: "/reset/{token}"
---

# Reset password

`POST /reset/{token}`

## Request body

- ResetPassword
  - `password` string, required — Password
  - `password_confirm` string, required — Password - again

## Response `200`

Reset response

- DefaultJsonResponse
  - `user` object, required — By default just 'id', and 'authentication_token' are returned. However by overriding _User::get_security_payload()_ any attributes of the User model can be returned.
    - `id` integer, required — Unique user id (primary key)
    - `authentication_token` string — Token to be used in future token-based API calls.
  - `csrf_token` string — Session CSRF token

## Other responses

- `302` — Password has been reset or validation error (non-json)
- `400` — Errors while validating form

## Changes

- **2019-07-23** `11c8459a5c04` — 2 breaking, 1 warning, 3 info
  - the `response/errors` response's property type/format changed from `array`/`` to `object`/`` for status `400`
  - removed the required property `meta` from the response with the `200` status (media type: application/json)
  - removed the optional property `response/field_errors` from the response with the `400` status
  - added the optional property `csrf_token` to the response with the `200` status (media type: application/json)
  - …2 more

[Change history](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/changes/reset/:token/post.md)

---

[API](https://skmtc.dev/pallets-eco/apis/flask-security-external-api.md) · [All operations](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pallets-eco/flask-security-external-api/revisions/11c8459a5c04/schema)