Validate a password-reset code

POST 
/api/v1/auth/reset-password/:challengeId/validate

On success issues a restricted safebucket_mfa_token cookie (audience auth:mfa:password-reset) used to complete the reset via /complete, optionally after an MFA step-up if the account has MFA enabled.

Request

Responses

201

Code verified; restricted token issued

Response Headers

Set-Cookie

New safebucket_mfa_token cookie (audience auth:mfa:password-reset)

400

Challenge invalid, expired, or has no associated user (INVALID_REQUEST)

401

Wrong code (WRONG_CODE)

403

Challenge locked after too many failed attempts (CHALLENGE_LOCKED)