Redeems the single-use JWT carried by a password-reset email and replaces the actor's password. The token is HMAC-signed, purpose-scoped, expires after a short TTL, and is consumed on first use — a consumed token is dead and a new link must be requested.

POST/auth/reset-password

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request body for POST /auth/reset-password.

token*string

The HMAC JWT from the reset link.

password*string

New password.

Response Body

`application/problem+json`

curl -X POST "https://example.com/auth/reset-password" \  -H "Content-Type: application/json" \  -d '{    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",    "password": "S3curePassw0rd!"  }'

Empty

{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 400,
  "title": "Validation Failed"
}

{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 500,
  "title": "Internal Server Error"
}

{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 503,
  "title": "Identity Unavailable"
}

Set a new password with a reset link

Request Body

Response Body

204

400application/problem+json

500application/problem+json

503application/problem+json

`application/problem+json`

`application/problem+json`

`application/problem+json`