POST/api/auth/reset-password/confirmPublic

Reset the password with an e-mailed token

Consumes a password reset token and sets the new password. Every session and token issued before the reset is invalidated (the user's tokens_valid_after watermark moves), so the user has to log in again everywhere. Rate limited per IP.

operationId post_api_auth_reset_password_confirmAuthentication

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials
None required
Notes
The single-use reset token is the credential.

Request body

Required — The body is parsed by the handler itself so its error format stays stable.

application/json
PasswordResetConfirmRequestUnknown keys are rejected.
PropertyTypeDescription
token*string (uuid)

The reset token from the e-mailed link (?token=)

new_password*string

New password (must satisfy the password policy)

minLength: 10maxLength: 255

JSONExample
"token""123e4567-e89b-12d3-a456-426614174000"
"new_password""string"

Responses

application/json
SuccessMessageResponse
PropertyTypeDescription
success*true
message*string
JSONExample
"success"true
"message""string"

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/auth/reset-password/confirm' \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "123e4567-e89b-12d3-a456-426614174000",
  "new_password": "string"
}'
POST /api/auth/reset-password/confirm | SchemaVaults Auth API