Request a password-reset email (no-enumeration surface).
const url = 'https://api.tradr.cloud/api/auth/password-reset/request';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"email":"hello@example.com"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.tradr.cloud/api/auth/password-reset/request \ --header 'Content-Type: application/json' \ --data '{ "email": "hello@example.com" }'Public. Rate limited by client IP (5 / 15 min, the register posture) AND by the normalized target email (3 / 1 h — REQ-3.8’s per-target bound; case variants share one bucket). Responds the identical generic 200 { success: true } whether or not the email matches an account and regardless of delivery outcome (REQ-3.2/3.3 — no account-existence or delivery-health oracle). When an account exists, a single-use reset token (60 min TTL, newest-wins over prior tokens) is issued and the reset email dispatched WITHOUT awaiting delivery (REQ-2.7). When the instance has no email configured the endpoint returns a stable 409 EMAIL_NOT_CONFIGURED for every caller — instance-level, account-independent (REQ-1.2, D12).
Request Bodyrequired
Section titled “Request Bodyrequired”object
Examplegenerated
{ "email": "hello@example.com"}Responses
Section titled “Responses”{ success: true } — identical for existing and nonexistent accounts.
Validation error (malformed email).
EMAIL_NOT_CONFIGURED — this instance has no email configured.
Rate limit reached (IP-keyed or per-target).