tessera

Sends a password reset link, if there is an account and mail is configured.

POST
/api/v1/auth/password-reset

Why this always answers the same way

202 whether or not the address belongs to an account, and whether or not the mail reached the relay. Any other shape turns this into a way to ask "does this person have an account here", answerable by anyone at whatever rate the throttle allows.

The cost is that a typo produces no feedback. A mistyped address is noticed when no mail arrives.

Errors

404 when this instance sends no mail. The route is not mounted, so that is the router's answer. 429 when this address has already been sent as many links as the window allows.

application/json
  1. body

Body of POST /auth/password-reset.

email*string

The address to send the link to.

Response Body

Accepted; a link is sent if that address has an account

curl -X POST 'https://example.com/api/v1/auth/password-reset' \  -H 'Content-Type: application/json' \  -d '{  "email": "string"}'
Empty