How to send a reset password request via API?

rhasan · March 17, 2021, 12:28am

Hi,

I wonder if there is a way to send a reset password request via an API call? Or perhaps just reset the password via api (then my code will email the user).

For example, I can do this PATCH request but it doesnt sets the password:

PATCH ‘https://******/api/user/v1/accounts/{username}’
{
“name”: “Lorem Ipsum”,
“password”: “newpassword” //doesntwork!!
}

Similarly, I tried the following, doesnt work:

POST /password_reset/
POST /account/password

jramnai · March 17, 2021, 4:57am

Hello @rhasan,

For the password reset you can use these endpoints:

api/user/v1/account/password_reset/
api/user/v1/account/password_reset/token/validate/

And for all API endpoint details, you can check this URL.

References:

github.com

edx/edx-platform/blob/master/openedx/core/djangoapps/user_authn/urls_common.py#L72


url(r'^user_api/v1/account/login_session/$', login.LoginSessionView.as_view(),
    name="user_api_login_session_legacy"),

# Login Refresh of JWT Cookies
url(r'^login_refresh$', login.login_refresh, name="login_refresh"),

url(r'^logout$', logout.LogoutView.as_view(), name='logout'),

# Moved from user_api/legacy_urls.py
url(
    r'^api/user/v1/account/password_reset/$',
    password_reset.PasswordResetView.as_view(),
    name="user_api_password_reset"
),
# legacy url
url(r'^user_api/v1/account/password_reset/$', password_reset.PasswordResetView.as_view(),
    name="user_api_password_reset_legacy"),

# Password reset api views.
url(r'^password_reset/$', password_reset.password_reset, name='password_reset'),
url(

github.com

edx/edx-platform/blob/master/openedx/core/djangoapps/user_authn/urls_common.py#L91


url(r'^password_reset/$', password_reset.password_reset, name='password_reset'),
url(
    r'^password_reset_confirm/(?P<uidb36>[0-9A-Za-z]+)-(?P<token>.+)/$',
    PasswordResetConfirmWrapper.as_view(),
    name='password_reset_confirm',
),
url(r'^account/password$', password_reset.password_change_request_handler, name='password_change_request'),

# authn MFE flow
url(
    r'^api/user/v1/account/password_reset/token/validate/$',
    password_reset.PasswordResetTokenValidation.as_view(),
    name="user_api_password_reset_token_validate"
),
# legacy url
url(r'^user_api/v1/account/password_reset/token/validate/$', password_reset.PasswordResetTokenValidation.as_view(),
    name="user_api_password_reset_token_validate_legacy"),

# authn MFE reset flow
url(
    r'^password/reset/(?P<uidb36>[0-9A-Za-z]+)-(?P<token>.+)/$',

rhasan · March 18, 2021, 6:02am

The first endpoint (/user/v1/account/password_reset/) is a GET only for some useless reason. It says there

“HTTP end-point for GETting a description of the password reset form.”

The 2nd endpoint (/user/v1/account/password_reset/token/validate/) is to validate token. There isnt one to reset the password or generate a reset password request.

jramnai · March 18, 2021, 6:51am

You are right about this but this will give you the form field data which require to submit for the password reset request.

I have tried this one in the Postman and have received Password reset email on the success of it. Please check your logs for this request and verify what is going wrong. One more thing is that you should pass the email in this POST request.

Reference:

github.com

openedx/edx-platform/blob/master/openedx/core/djangoapps/user_authn/views/password_reset.py#L284


      
                      request=get_current_request(),
                  )
              else:
                  # No user with the provided email address exists.
                  raise errors.UserNotFound
          
          
          @csrf_exempt
          @require_POST
          @ratelimit(key=POST_EMAIL_KEY, rate=settings.PASSWORD_RESET_EMAIL_RATE, block=False)
          @ratelimit(key=REAL_IP_KEY, rate=settings.PASSWORD_RESET_IP_RATE, block=False)
          def password_reset(request):
              """
              Attempts to send a password reset e-mail.
              """
              user = request.user
              # Prefer logged-in user's email
              email = user.email if user.is_authenticated else request.POST.get('email')
              AUDIT_LOG.info("Password reset initiated for email %s.", email)
          
              if getattr(request, 'limited', False):

rhasan · March 18, 2021, 7:01am

Thanks for the reply buddy.

I have tried this one in the Postman and have received Password reset email on the success of it. Please check your logs for this request and verify what is going wrong. One more thing is that you should pass the email in this POST request.

How did you pass the email param? JSON? or form-data?

jramnai · March 18, 2021, 7:23am

As a form-data in Body of Postman.

rhasan · March 18, 2021, 7:27am

Oh I got it, it works now. Thanks.
Because everything else works on Json data so I was passing json previously.

rhasan · March 18, 2021, 7:28am

Do you know where is the template for this email? it looks pretty awful

Topic		Replies	Views
How to reset password using API Development api , how-to	1	612	April 30, 2021
Reset password email Site Operators	0	9	February 10, 2025
Security: patch for password reset Security	0	618	October 7, 2020
Invalid password reset link Development koa	7	1680	June 18, 2021
API Authentication Site Operators api , how-to , tutor	5	1471	May 16, 2022

How to send a reset password request via API?

Related topics