---
title: "Forgot Password"
method: POST
path: "/v1/auth/forgot"
---

# Forgot Password

`POST /v1/auth/forgot`

## Request

- Base URL: `https://api.quantradin.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.quantradin.com/v1/auth/forgot`
- Auth: none declared

Start a password reset.  ALWAYS returns 200 {"ok": true} — byte-identical
whether or not the email is registered (no account enumeration).  When the
email DOES match a user, a single-use, 30-minute reset link is emailed
(dev: logged).  The token is never returned in this response.

IMPORTANT-1a: the token-INSERT + mail-send are scheduled via
BackgroundTasks, not run inline — the response is written before that
work happens, so a caller timing the request can't distinguish "email
exists, token+mail scheduled" from "email unknown, nothing scheduled" by
response latency (the one lookup that DOES run inline, user_id_by_email,
is a single indexed SELECT either way).

RATE-LIMITED per IP (launch #7, 2026-08-12): without it a loop on a known
member's address is a MAIL BOMB — one real Resend send per request, burning
quota and the member's inbox. Same auth_limiter + rightmost-XFF IP as
login/signup, checked BEFORE the lookup so a flood consumes no DB work.
The 429 is still enumeration-safe: it's keyed on IP, never on whether the
email exists.

## Request body

- ForgotBody
  - `email` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/quantradin/apis/vega-api.md) · [All operations](https://skmtc.dev/quantradin/apis/vega-api/llms.txt) · [OpenAPI document](https://skmtc.dev/quantradin/apis/vega-api/revisions/47add154ef38?raw)