---
title: "Initiate password recovery process for a user account."
method: POST
path: "/api/v1/user/{user}/recover-password"
---

# Initiate password recovery process for a user account.

`POST /api/v1/user/{user}/recover-password`

**Rate Limited**: Subject to password recovery rate limits (configurable)
**Access**: Public endpoint - no authentication required
**Security**: Rate limited to prevent abuse and email flooding

**Path Parameters**:
- `user`: User identifier (email address or numeric ID)

**Request**: No request body required

    **Recovery Process**:
1. Validates user exists and account is active
2. Generates secure password reset token with 1-hour expiration
3. Sends password recovery email with reset link
4. User clicks link and sets new password via /user/reset-password endpoint

**Success Response Schema**:
```json
{
  "data": {
    "message": "If an account with that email exists,
      a password recovery email has been sent."
  }
}
```

**Security Notes**:
- Returns the same response regardless of whether the user exists,
  preventing user enumeration attacks (CWE-204).
    - Rate limiting prevents email flooding attacks.

**Error Responses**:
- `429 Too Many Requests`: Rate limit exceeded
- `500 Internal Server Error`: System error (email failures are masked)

## Path parameters

- `user` string, required

## Request body

- object

## Response `200`

Success

- object

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

---

[API](https://skmtc.dev/trends/apis/trends-earth-api.md) · [All operations](https://skmtc.dev/trends/apis/trends-earth-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trends/trends-earth-api/revisions/6bdbc0b84666/schema)