API referenceAccount
Reset a password with a recovery code
POST
Public recovery endpoint for zero-PII accounts. Consumes one recovery code and sets a new password; the code is single-use. Failures are deliberately uniform so the endpoint cannot be used to enumerate usernames.
CognitoUserPoolheader
AuthorizationBearer <token>Cognito user pool ID token. API Gateway validates the token (identity
token: no OAuth scopes are configured on the authorizer) and forwards
its claims; the sub claim is the tenant key.
application/json- body
username*stringThe account username.
code*stringOne unused recovery code.
new_password*stringNew password, at least 12 characters.
Length
12 <= lengthPassword reset.
application/json- response
message*stringHuman-readable result.
curl -X POST "https://example.com/auth/reset" \ -H "Content-Type: application/json" \ -d '{ "username": "string", "code": "string", "new_password": "stringstring" }'{ "message": "string"}