# Send reset password email

Canonical page: https://docs.ovok.com/api/reset-password/send-reset-password-email

`POST /v2/auth/reset-password`

Sends a password reset email to a Patient, a RelatedPerson (carer) or a Practitioner. The answer is the same whether or not an account exists, so the route cannot be used to find out which emails are registered.

**Auth:** none.
**Scope:** for a Patient or RelatedPerson, the project that owns `clientId`. For a Practitioner, the account is found by email across projects.

## Behaviour

- `type` is `Patient`, `RelatedPerson` or `Practitioner`. `clientId` is required when `type` is `Patient` or `RelatedPerson` and is ignored for a Practitioner.
- The response is always a FHIR `OperationOutcome` saying "If the user exists, a password reset email has been sent." It is returned for unknown emails, unknown client IDs and accounts that could not be mailed.
- When the account exists, Ovok creates a reset request, which replaces any earlier open reset request for the user, and emails the user. Patients and RelatedPersons get the `PATIENT_RESET_PASSWORD` template and Practitioners the `RESET_PASSWORD` template.
- The email carries a link `<app URL>/setpassword/<id>/<secret>` plus the request `id` and `secret`. The app URL is the project's patient app URL for a Patient or RelatedPerson, and its practitioner app URL for a Practitioner; if none is set, the request's `Origin` is used when it is an allowed one.
- A Practitioner who is a member of more than one project gets a link to the Ovok platform app instead of a project's app URL.
- If no app URL can be found, the email still goes out, without a link. The `id` and `secret` in it can be sent to `POST /v2/auth/reset-password/process`.
- If a Practitioner has several accounts, the first one found is used.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/v2/auth/reset-password' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "max.mustermann@example.com",
    "clientId": "c3499c27-2973-0a7f-807e-fb8676a92dcb",
    "type": "Patient"
  }'
```