---
title: "Set or reset a password"
method: POST
path: "/v1/auth/password-resets"
tags: ["auth"]
---

# Set or reset a password

`POST /v1/auth/password-resets`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/auth/password-resets`
- Auth: none declared

Redeems a set/reset link, writes the new password, and invalidates every session and access token the old credential could still reach. The caller then signs in normally.

## Request body

- PasswordResetRequest: Redeem a set/reset link and write the new password.
  - `token` string, required: The opaque token from the emailed link.
  - `password` string, password, required

## Response `200`

Acknowledgement; the password is now set.

- AuthEmailAcceptedResponse: The ONE answer both link-request endpoints give, whatever the address. A body that varied by outcome — or a 404 for an unknown address — would turn either endpoint into an account-existence oracle for anyone who can type an email in.
  - `status` 'accepted'

## Other responses

- `400`: The link is not valid — expired, already used, or unrecognized (``INVALID_AUTH_ACTION``)
- `422`: Validation Error
- `429`: Too many requests from this client (``RATE_LIMITED``)

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)