Set a new password with the emailed token

POST

/security/password/reset

One-time and short-lived; every other reset link still open for the
account dies with it. A successful reset ends every session — whoever
forced it should not stay signed in on a device the owner does not
hold — except service sessions, unless includeServices is true.
On the strict rate-limit tier.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Changed

Bodyapplication/json

🟠400

🟠429TooManyRequests

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/password/reset' \
--header 'Content-Type: application/json' \
--data '{
    "token": "string",
    "password": "pa$$word",
    "conf-password": "pa$$word",
    "includeServices": false
}'

Response Example

200 - Example 1

{
    "message": "string"
}

Modified at 2026-10-05 04:04:32

Ask for a reset link

Open a device-bound klock session