Create Password Reset URL and Send by Email
POST /obp/v7.0.0/management/user/reset-password-url
OBPv6.0.0-resetPasswordUrl Roles: CanCreateResetPasswordUrl User
Create a new password reset URL for a user and send it to them by email. The URL travels only via email — it is NOT returned in the response.
Authentication is Required.
Behavior:
- Generates a unique password reset token (rotates the user's uniqueId)
- Builds a reset URL using the portal_external_url property
- Sends the URL to the user by email
- Returns only delivery acknowledgement ({"status": "sent", "to": "user@example.com"})
Required fields:
- username: The user's username (typically email)
- email: The user's email address (must match username)
- user_id: The user's UUID
The user must exist and be validated before a reset URL can be generated.
Email configuration (portal_external_url, SMTP, sender address) must be set up correctly for delivery to succeed. See /status (Email section) and POST /obp/v7.0.0/management/self-test-emails for diagnostics.
Security note: the reset URL is intentionally not returned in the response. Returning it would let any caller with canCreateResetPasswordUrl complete a reset without controlling the target mailbox, defeating the email-proves- mailbox-ownership property of the flow.
User Authentication is Required. The User must be logged in. The Application must also be authenticated.
JSON request body fields (3)
JSON response body fields (2)
- status
- to
Example request body
{
"username": "user@example.com",
"email": "user@example.com",
"user_id": "74a8ebcc-10e4-4036-bef3-9835922246bf"
}Example success response
{
"status": "sent",
"to": "user@example.com"
}Possible errors (4)
- OBP-20001: User not logged in. Authentication is required!
- OBP-20006: User is missing one or more roles:
- OBP-10001: Incorrect json format.
- OBP-50000: Unknown Error.