Initiate password recovery process for a user account.

Rate Limited: Subject to password recovery rate limits (configurable) Access: Public endpoint - no authentication required Security: Rate limited to prevent abuse and email flooding

Path Parameters:

• user: User identifier (email address or numeric ID)

Request: No request body required

**Recovery Process**:

1. Validates user exists and account is active
2. Generates secure password reset token with 1-hour expiration
3. Sends password recovery email with reset link
4. User clicks link and sets new password via /user/reset-password endpoint

Success Response Schema:

{
  "data": {
    "message": "If an account with that email exists,
      a password recovery email has been sent."
  }
}

Security Notes:

• Returns the same response regardless of whether the user exists, preventing user enumeration attacks (CWE-204).
  • Rate limiting prevents email flooding attacks.

Error Responses:

• 429 Too Many Requests: Rate limit exceeded
• 500 Internal Server Error: System error (email failures are masked)