Vigilfield Docs
API referenceAccount

Account_set_password

POST/account/passwords

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

curl -X POST "https://example.com/account/passwords" \  -H "Content-Type: application/json" \  -d '{    "password": "string",    "token": "string"  }'
{  "email": "string",  "org_id": "string",  "user_id": "string"}

`POST /account/forgot-password`. Unauthenticated. Always returns 202 — the response shape is identical whether the email matches a real user, matches a federated user, or matches nothing. Anti-enumeration is the whole point: callers learn nothing from the response except "we accepted your request". POST

When the email matches a non-federated user, we generate a fresh setup token (the same machinery signup and invitation use) and email the user a `<slug>.<apex>/set-password#<token>` link. Since rh-j4af1x the user's row is **not** touched: this request proves nothing about who sent it, and `POST /account/passwords` accepts the token on the token row rather than on the user's status. Federated users (`provisioned_by.is_some()`) never get a token — their credentials live in their IdP, not in Cognito. Auditing distinguishes every outcome (`sent` / `skipped_federated` / `skipped_unknown` / …) so operators can spot enumeration attempts.

`POST /alert-destinations` POST

Next Page