Forgot Password
Initiate a password reset. Send the user's email; if an account with that address exists, a reset link is emailed (token valid for one hour). The endpoint is intentionally enumeration-resistant — it returns the same 200 OK response whether or not the email maps to a real account, so callers cannot use it to probe for valid users.
Existing reset tokens for the same user are invalidated as soon as a new one is issued. Rate-limited per IP (3 attempts / 15 min) and per email (same window) to prevent inbox flooding.
Request body
email string Req
Email address registered on the account. Case-insensitive.
Response (200 OK)
message string
Constant friendly message — does not leak whether the address mapped to a real user.
Errors
400 Bad Request
Missing or empty
email.429 Too Many Requests
Per-IP or per-email rate limit hit. Wait the documented window before retrying.
Next step
The user clicks the link in their inbox, which lands on a page that POSTs to /auth/reset-password with the embedded token + their chosen new password.
Request
curl -X POST "https://api.ngris.com/v1/auth/forgot-password" \
-H "Content-Type: application/json" \
-d '{"email": "user@example.com"}'
Python
from ngris import Ngris
client = Ngris(api_key="placeholder")
client.auth.forgot_password("user@example.com")
Response — 200 OK
{
"message": "If an account exists with that email, a password reset link has been sent."
}