API reference / Accounts
post
/v2/accounts/password-reset/confirmSet a password from a mailed link
- Operation
confirmPasswordReset- Authentication
- None — public
Serves the reset a customer asked for and the invitation an operator sent: both set the password on an account. Redeeming also confirms the address, because opening a link mailed to it is proof of the inbox. Every live session for the account is revoked — a reset that leaves a stolen session alive has not reset anything. The link works once: its signature covers a digest of the password hash it was minted against.
Request
Body
tokenstringrequiredpasswordstringrequiredResponses
200Password set. Sign in normally afterwards.
statusstringrequiredmessagestringrequired400The request body or query failed validation.
errorobjectrequired401The link is not valid, has expired, or has already been used.
errorobjectrequiredExample
curl -X POST https://api.haavisa.com/v2/accounts/password-reset/confirm \
-H "Content-Type: application/json" \
-d '{
"token": "<token>",
"password": "<password>"
}'More in Accounts
POST/v1/tokenGET/v1/token/introspectPOST/v1/token/mfaPOST/v1/token/revokePOST/v2/accountsGET/v2/accounts/mePATCH/v2/accounts/meGET/v2/accounts/me/messaging-consentPUT/v2/accounts/me/messaging-consentPOST/v2/accounts/mfa/activatePOST/v2/accounts/mfa/disablePOST/v2/accounts/mfa/enrollPOST/v2/accounts/password-resetPOST/v2/accounts/sign-inPOST/v2/accounts/sign-outPOST/v2/accounts/verify-emailPOST/v2/accounts/verify-email/resend
Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.