--- title: "Resetstart" method: POST path: "/v1/b2b/passwords/discovery/email/reset/start" tags: ["Discovery"] --- # Resetstart `POST /v1/b2b/passwords/discovery/email/reset/start` ## Request - Base URL: `https://api.stytch.com` - URL: `https://api.stytch.com/v1/b2b/passwords/discovery/email/reset/start` - Auth: HTTP basic Initiates a password reset for the email address provided, when cross-org passwords are enabled. This will trigger an email to be sent to the address, containing a magic link that will allow them to set a new password and authenticate. This endpoint adapts to your Project's password strength configuration. If you're using [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy), the default, your passwords are considered valid if the strength score is >= 3. If you're using [LUDS](https://stytch.com/docs/guides/passwords/strength-policy), your passwords are considered valid if they meet the requirements that you've set with Stytch. You may update your password strength configuration on the [Passwords Policy page](https://stytch.com/dashboard/password-strength-config) in the Stytch Dashboard. ## Request body - ApiB2bPasswordV1B2bPasswordsDiscoveryEmailResetStartRequest: Request type - `email_address` string, required: The email address of the Member to start the email reset process for. - `reset_password_redirect_url` string: The URL that the Member is redirected to from the reset password magic link. This URL should display your application's reset password page. Before rendering the reset page, extract the `token` from the query parameters. On the reset page, collect the new password and complete the flow by calling the corresponding Password Reset by Email endpoint. If this parameter is not specified, the default Reset Password redirect URL configured in the Dashboard will be used. If you have not set a default Reset Password redirect URL, an error is returned. - `discovery_redirect_url` string: The URL that the end user clicks from the discovery Magic Link. This URL should be an endpoint in the backend server that verifies the request by querying Stytch's discovery authenticate endpoint and continues the flow. If this value is not passed, the default discovery redirect URL that you set in your Dashboard is used. If you have not set a default discovery redirect URL, an error is returned. - `reset_password_template_id` string: Use a custom template for reset password emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Passwords - Reset Password”. - `reset_password_expiration_minutes` integer: Sets a time limit after which the email link to reset the member's password will no longer be valid. The minimum allowed expiration is 5 minutes and the maximum is 10080 minutes (7 days). By default, the expiration is 30 minutes. - `pkce_code_challenge` string - `locale` string: Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`. If no value is provided, the copy defaults to English. - `verify_email_template_id` string: Use a custom template for verification emails sent during password reset flows. When cross-organization passwords are enabled for your Project, this template will be used the first time a user sets a password via a password reset flow. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Passwords - Email Verification”. ## Response `200` Successful response - ApiB2bPasswordV1B2bPasswordsDiscoveryEmailResetStartResponse - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue. - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors. ## Other responses - `400`: Bad request - `401`: Unauthorized - `429`: Too Many Requests - `500`: Internal server error ## Changes - **2026-03-07** `110f26a94e5b`: 1 info - endpoint added - **2026-03-06** `9cab20b8eca7`: 1 breaking - api path removed without deprecation - **2025-09-17** `8270cf3a3d4c`: 3 info - added the media type `application/json` for the response with the status `401` - added the media type `application/json` for the response with the status `500` - added the non-success response with the status `429` - **2025-09-17** `25964b4a5e32`: 1 info - api operation id `api_multitenant_password_v1_b2b_passwords_discovery_email_ResetStart` removed and replaced with `api_b2b_password_v1_b2b_passwords_discovery_email_ResetStart` - **2025-09-17** `864b9f438ac0`: 2 breaking - the `reset_password_expiration_minutes` request property type changed from `string` to `integer`, and format from no format to `int32` - the `status_code` response's property type changed from `string` to `integer`, and format from no format to `int32` for status `200` [Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/b2b/passwords/discovery/email/reset/start/post.md) --- [API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)