Request a password-reset link.
POST/v1/auth/password/forgot
Always 202 — the response is identical whether the address exists or not (no account enumeration); when it does, a 30-minute single-use reset link is sent asynchronously.
Rate limit: 10 / 15 minutes per client IP and per e-mail.
No authentication is required for this endpoint.
Request
Responses
- 202
- 400
- 429
Accepted (uniform).
Request was malformed or failed validation. The error.code field carries the
machine-readable reason; common values include invalid_request, invalid_json,
invalid_order_id, invalid_instrument_id, invalid_credential_id,
invalid_resolution, and operation-specific codes documented per endpoint.
Too many attempts inside the fixed rate-limit window (10 attempts / 5 minutes per key). Retry in a few minutes.