Recovery Confirm

Finalizes password recovery by verifying a security code and token, then setting a new password. Returns new authentication tokens upon success.

Endpoint

POST/v2/auth/recovery/confirm

Link

Gateway APIstagep.tst-apidmndelss.com

Request

Headers

Key	Value	Required
Authorization	Bearer <JWT>	Yes
Content-Type	application/json	Yes
Accept	application/json	Yes

Request Body (JSON)

Field	Type	Description	Required	Example
code	string	Recovery code (from email/SMS).	Yes	"A1B2C3"
token	string	One-time recovery token.	Yes	"xyz789abc"
password	string	New password.	Yes	"NewSecurePass123!"
repeatPassword	string	Must match password exactly.	Yes	"NewSecurePass123!"

Example Request Body:

json

{
  "code": "A1B2C3",
  "token": "xyz789abc",
  "password": "NewSecurePass123!",
  "repeatPassword": "NewSecurePass123!"
}

---

Response (200 OK)

Returns new authentication tokens for immediate login.

Response Fields

Field	Type	Description	Example
accessToken	string	JWT for API access.	"eyJhbGci...xyz"
refreshToken	string	Long-lived token for renewing access.	"eyJhbGci...abc"
guid	string	User identifier.	"usr_5f3d8e2a"

Example Response:

json

{
  "accessToken": "eyJhbGci...xyz",
  "refreshToken": "eyJhbGci...abc",
  "guid": "usr_5f3d8e2a"
}

Error Responses

1. Invalid Code/Token:

   json

   {
     "error": "Invalid recovery code or token"
   }

2. Password Mismatch:

   json

   {
     "error": "Passwords do not match"
   }

3. Weak Password:

   json

   {
     "error": "Password must contain at least 8 characters, including uppercase and numbers"
   }

---

Notes

• Token Validity:

  • Recovery tokens typically expire after 15 minutes.
• Password Rules:

  • Minimum 8 characters.
  • Requires uppercase, lowercase, and numbers/symbols.
• Security:

  • Old passwords are invalidated immediately.
  • Active sessions using the old password are terminated.

Examples

Real request

Real response