TrieOH
IdentityXAPIAuthn

Request a password reset link

Mints a single-use password-reset link and emails it to the given address. Always returns 200 — unknown emails and passwordless (OAuth-only) accounts are silent no-ops, so the endpoint does not leak which emails are registered.

POST/auth/forgot-password

Mints a single-use password-reset link and emails it to the given address. Always returns 200 — unknown emails and passwordless (OAuth-only) accounts are silent no-ops, so the endpoint does not leak which emails are registered.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request body for POST /auth/forgot-password.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/auth/forgot-password" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com"  }'
{
  "code": 200,
  "message": "string",
  "data": {},
  "error": {
    "code": "BAD_REQUEST",
    "message": "string",
    "fields": [
      {
        "field": "string",
        "message": "string"
      }
    ],
    "meta": {},
    "debug": {
      "raw_error": "string",
      "stack_trace": "string"
    }
  },
  "pagination": {
    "page": 1,
    "limit": 1,
    "total": 0,
    "has_next": true,
    "has_prev": true,
    "next_page": 0,
    "prev_page": 0
  },
  "timestamp": "2019-08-24T14:15:22Z",
  "module": "string"
}
{
  "code": 0,
  "message": "string",
  "error": {
    "code": "BAD_REQUEST",
    "message": "string",
    "fields": [
      {
        "field": "string",
        "message": "string"
      }
    ],
    "meta": {},
    "debug": {
      "raw_error": "string",
      "stack_trace": "string"
    }
  },
  "timestamp": "2019-08-24T14:15:22Z",
  "module": "IdentityX"
}
{
  "code": 0,
  "message": "string",
  "error": {
    "code": "BAD_REQUEST",
    "message": "string",
    "fields": [
      {
        "field": "string",
        "message": "string"
      }
    ],
    "meta": {},
    "debug": {
      "raw_error": "string",
      "stack_trace": "string"
    }
  },
  "timestamp": "2019-08-24T14:15:22Z",
  "module": "IdentityX"
}
{
  "code": 0,
  "message": "string",
  "error": {
    "code": "BAD_REQUEST",
    "message": "string",
    "fields": [
      {
        "field": "string",
        "message": "string"
      }
    ],
    "meta": {},
    "debug": {
      "raw_error": "string",
      "stack_trace": "string"
    }
  },
  "timestamp": "2019-08-24T14:15:22Z",
  "module": "IdentityX"
}

Resend the verification email POST

Mints a fresh verification link and emails it to the given address. Always returns 200 — unknown emails and already-verified accounts are silent no-ops, so the endpoint does not leak which emails are registered.

Set a new password with a reset link POST

Redeems the single-use JWT carried by a password-reset email and replaces the actor's password. The token is HMAC-signed, purpose-scoped, expires after a short TTL, and is consumed on first use — a consumed token is dead and a new link must be requested.