Complete Password Reset
POST /obp/v7.0.0/users/password
OBPv6.0.0-resetPasswordComplete No role required User
Complete a password reset using the token received via email.
Authentication is NOT Required.
After requesting a password reset email (via POST /management/user/reset-password-url or POST /users/password-reset-url), the user receives an email with a reset link containing a JWT token.
This endpoint accepts that token along with a new password and completes the password reset.
The token is a signed JWT with a configurable expiry (default: 120 minutes). Configure the expiry with the property: password_reset_token_expiry_minutes
Required fields:
- token: The JWT reset token from the password reset email
- new_password: The new password (must meet strong password requirements)
The token is single-use. Once the password is reset, the token is invalidated.
User Authentication is Optional. The User need not be logged in.
JSON request body fields (2)
- new_password
- new_password
- token
JSON response body fields (1)
- message
- 123456
Example request body
{
"token": "a1b2c3d4e5f67890abcdef1234567890",
"new_password": "NewStr0ng!Password"
}Example success response
{
"message": "Password has been reset successfully."
}Possible errors (3)
- OBP-10001: Incorrect json format.
- OBP-30207: Invalid Password Format. Your password should EITHER be at least 10 characters long and contain mixed numbers and both upper and lower case letters and at least one special character, OR the length should be > 16 and <= 512.
- OBP-50000: Unknown Error.