---
title: "Reset Password Request"
method: POST
path: "/reset_password"
tags: ["Customer Actions"]
---

# Reset Password Request

`POST /reset_password`

Reset password API is a **synchronous POST-method** API call.

It allows Riskified to understand whether an account has been secured following an incident (if not it needs to be treated as a 'compromised' account). It also enables measuring account recovery rate - an important KPI for both Riskified and the merchants.

**When to trigger:**
- When a password-reset action has been requested
- When the request has been processed

**Response:**
`decision` is always `allow`.

## Headers

- `x-riskified-shop-domain` string, required
- `x-riskified-hmac-sha256` string, required
- `content_type` 'application/json', required
- `accept` 'application/vnd.riskified.com; version=2', required

## Request body

- ResetPasswordAction
  - `customer_id` string, required — A unique numeric identifier for the customer.
  - `email` string, required — The email address on the registered customer account.
  - `status` 'pending' | 'success' | 'failed', required — Indicates the status of the request. **Possible values:** - `pending`: Password reset has been requested but new password has not been set - `success`: Password has successfully been reset and old password is no longer valid - `failed`: Password failed to be reset and old password is still valid
  - `reason` 'user_requested' | 'forgot_password' | 'forced_reset', required — The reason for the password reset request. **Possible values:** - `user_requested`: Customer is logged in and initiates a password change from their account - `forgot_password`: Customer has forgotten password and directly initiates process to create a new password - `forced_reset`: An internal system-initiated password reset request
  - `client_details` ClientDetails, required — An object containing technical information regarding the customer’s browsing session
    - `user_agent` string, required — The full User-Agent sent from the client.
    - `accept_language` string, required — List of two-letter language codes sent from the client.
  - `session_details` SessionDetails, required — An object containing basic information regarding the session. Session data points, such as `cart_token`, `browser_ip`, and `user_agent`, should be those associated with values at the time of user's login request - **before** the authentication result is available.
    - `cart_token` string, required — The session id at the time that the user is on the login webpage or started password reset, prior to authentication attempt. Must match the `session_details.cart_token` value set by the Beacon JavaScript snippet. For standard integrations, this value is automatically generated by Beacon. For merchants who manage their own sessions, the same session ID must be passed to both the Beacon and this field. Must remain consistent throughout a purchase flow. Max 100 characters.
    - `browser_ip` string, required — The customer's browser IP address during the session.
    - `created_at` string, required — The date and time (ISO8601) of the session.
    - `source` 'desktop_web' | 'mobile_web' | 'web' | 'mobile_app' | 'other', required — The platform that the session originated from. **Possible values:** - `desktop_web`: Session originated on the website, using a desktop device - `mobile_web`: Session originated on the mobile website, using a mobile device - `web`: Session originated on the website, with no available info about the type of device used - `mobile_app`: Session originated on the mobile app, using a mobile device - `other`: The session's origin is unknown
    - `device_id` string — **(Conditional Requirement)** Required for mobile applications. The mobile device identifier, which corresponds to a value extracted via the Riskified mobile beacon SDK.
    - `referring_site` string — **(Strongly Recommended)** The webpage from which the customer accessed the shop. Domain level is enough, and usually set the shop_url provided by Riskified. In case you have several sites may be used by different population, set different url per the scenario (e.g. regular ec-site: www.shop-regular.com, employee ec-site: www.shop-employee.com)
  - `vendor_name` string — The name of the affiliated partner or selling vendor.

## Response `200`

Successful operation

- ResetPasswordActionResponse — The response to the reset password action request.
  - `decision` 'allow', required — The decision made by Riskified regarding the reset password attempt.

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `404` — Not found
- `429` — Too many requests
- `500` — Contact Riskified support
- `504` — Temporary error, please retry

---

[API](https://skmtc.dev/riskified/apis/chargeback-guarantee.md) · [All operations](https://skmtc.dev/riskified/apis/chargeback-guarantee/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/riskified/chargeback-guarantee/revisions/2b7df5bce861/schema)