Request password reset email

POSThttps://app.speybooks.com/api/v1/auth/forgot-password

Request a password reset email. The response is always the same success message whether or not the address belongs to an account, so a client must not infer account existence from it. When the address belongs to an active account, any earlier unused reset link is invalidated and a new one is emailed. The endpoint is rate limited with a short cooldown between requests.

Body parameters

emailstringrequired

Email address of the account to reset. Always returns success to prevent email enumeration.

Response

200Always returns success regardless of whether the email exists, to prevent enumeration attacks.

Show response fields

messagestring

Generic success message. Does not confirm account existence.

Error codes

429Rate limit exceeded. Try again later.

RequestPOST/v1/auth/forgot-passwordcurl

curl -X POST https://api.speybooks.com/v1/auth/forgot-password \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com"}'

Response200

{
  "success": true,
  "message": "If an account exists with this email, you will receive a password reset link shortly."
}