# Reset user password with the information from the email.

Canonical page: https://docs.ovok.com/api/reset-password/reset-user-password-with-the-information-from-the-email

`POST /v2/auth/reset-password/process`

Sets a new password using the `id` and `secret` from a reset email. Use it when your app handles the reset itself instead of sending the user to the emailed link.

**Auth:** none. The reset request `id` and `secret` are the credential.

## Behaviour

- The `id` and `secret` come from the email sent by `POST /v2/auth/reset-password`. The `password` is the new password.
- The password must have at least 12 characters, not counting spaces at either end, and must not be on Ovok's list of common and breached passwords. Any character is allowed and none is required. A refused password answers 422 with the error on `password`.
- An invite link (from `POST /auth/invite` or a practitioner invite) sets a password for 7 days after it was sent. After that it answers 410 `This invite link has expired. Ask for a new invite.`, and inviting the user again sends a fresh link. Reset links are not limited this way.
- A request can be used once. Ovok marks it used before it changes the password, so a request whose password change then fails cannot be retried and the user must ask for a new email.
- Setting the password also marks the user's email as verified, because the secret came by email.
- The response is a minimal `User` with `resourceType`, `id` and `email`.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/v2/auth/reset-password/process' \
  -H 'Content-Type: application/json' \
  -d '{
    "id": "c3499c27-2973-0a7f-807e-fb8676a92dcb",
    "secret": "k3J9xQ2mV7",
    "password": "Ex4mple-Passw0rd"
  }'
```