Reset Password

Reset Password (Forgot Password, Not Logged In)

Resets the password of a user who cannot log in and is using a forgot-password flow.

This endpoint is used when the user is not authenticated and requests a password reset using a verified identity channel such as email or mobile number. The system validates a one-time reset verification code (activation_code) issued for the reset-password flow. If valid and not expired, the password is updated to new_password and takes effect immediately.

If verification fails, the password remains unchanged and an error response is returned.

Authentication

✅ Recommended (better security): a short-lived reset token issued after initiating reset

Authorization: Bearer <reset_token>

> If you don’t use a reset token, you must enforce strong rate limiting + OTP attempt throttling on this endpoint.

Request Body (Form Data)

* email_id or mobile_number (required to identify user)
* activation_code (required)
* new_password (required)
* user_id (optional, if your reset flow already resolved it)

Behavior Notes

* Requires a prior call to initiate reset and send OTP/code (mode = forgot password).
* Must enforce code attempt limits and expiration strictly.

One-Line Summary

> Resets a user’s password (forgot-password flow) after validating a one-time reset code sent to email or mobile.

curl --location --request POST 'https://appfloor.in/auth-service/password/reset' \ --form 'mobile_number=""' \ --form 'email_id=""' \ --form 'new_password=""' \ --form 'activation_code=""' \ --form 'app_id=""'

Reset Password (Forgot Password, Not Logged In)#

Authentication#

Request Body (Form Data)#

Behavior Notes#

One-Line Summary#

Request

Responses

Reset Password (Forgot Password, Not Logged In)

Authentication

Request Body (Form Data)

Behavior Notes

One-Line Summary