Set a new password with a reset code
POST/admin/auth/password/reset
Answers 204 and no session. Handing out a cookie here would make an
inbox on its own enough to reach the console, which is exactly what the second
factor on sign-in exists to prevent — sign in afterwards.
This is the tightest throttle on the surface: the code is six digits, so the per-address bucket is the only thing between an attacker without the inbox and a million guesses.
Request
Responses
- 204
- 400
- 401
- 403
- 429
Password changed — sign in with it
Malformed body, email/code missing, or the new password is too short
invalid_code — wrong, expired or already used, collapsed into one answer
account_suspended
too_many_requests