Reset password using a secure token from password recovery email.

Rate Limited: Subject to password recovery rate limits (configurable) Access: Public endpoint - no authentication required Security: Token-based authentication, tokens expire after 1 hour

Request Body Schema:

{
  "token": "secure-reset-token-from-email",
  "password": "new-secure-password"
}

Password Requirements:

• Minimum 8 characters
• Must contain at least one uppercase letter
• Must contain at least one lowercase letter
• Must contain at least one digit

Success Response Schema:

{
  "data": {
    "message": "Password reset successful"
  }
}

Security Features:

• Tokens are single-use (marked as used after successful reset)
• Tokens expire after 1 hour
• Rate limiting prevents brute force attacks
• Password strength validation enforced

Error Responses:

• 400 Bad Request: Missing token or password
• 404 Not Found: Invalid or expired token
• 422 Unprocessable Entity: Password doesn't meet requirements
• 429 Too Many Requests: Rate limit exceeded
• 500 Internal Server Error: System error