Start a password-reset flow

POST/api/auth/password/reset/request

requestPasswordReset

Anonymous endpoint. Always returns `202 Accepted` with `{ ok: true }`, regardless of whether the email exists, whether the account is verified, or whether the account has a password set. The response shape MUST NOT leak account existence. Rate limited per source IP (visible 429) and normalized email (silently retains the 202 contract).

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/password/reset/request' \
  -H 'Content-Type: application/json' \
  -d '{"email":"alice@example.com"}'

fetch

fetch("https://neosource.dev/api/auth/password/reset/request", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"email":"alice@example.com"}),
});

Request bodyrequired

application/json

PasswordResetRequest

object

Request body for `POST /api/auth/password/reset/request`. The endpoint is enumeration-safe: every call returns the same `202 Accepted` shape regardless of whether the email exists.

emailrequired: string
example"alice@example.com"

additional propertiesnot allowed

Responses

202Reset link dispatched if applicable (always — enumeration-safe)

application/json

PasswordResetRequestResponse

object

okrequired: boolean

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
429Rate limited — retry after the interval in the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget