Forgot Password

Initiates the forgot-password flow. Sends a password reset email if the account exists. The response is non-enumerating — it always returns success regardless of whether the email is registered, to prevent user enumeration attacks.

Headers

X-Correlation-Id
Type: string

Optional caller-provided correlation ID; echoed in responses when present.

Body·

required

application/json

client
Type: string
required

OAuth client ID provided by the business. Required to identify the client application for forgot password. The OAuth application must have the Advance Auth scope enabled.
email
Type: string Format: email
required

Email address of the user for which the forgot password request is made. The email should be registered with the business.
token_in_response
Type: boolean

Set true if you need reset password token in the response to forgot password API. It will be false by default.

Responses

application/json
application/json
application/json
application/json
application/json
application/json

post/api2/basic_auth/forgot_password

curl https://SERVER_NAME_GOES_HERE/api2/basic_auth/forgot_password \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "client": "CLIENT_GOES_HERE",
  "email": "test@example.com",
  "token_in_response": false
}'

{
  "data": [
    "If the email exists, a reset email will be sent"
  ]
}

Forgot password email sent (if account exists)