Forgot password

Resets a password in three steps: request a code, check the code, then set a new password.

This flow is for password accounts. Single sign-on email domains are rejected.

Asurion-enduser is required on verify and must match the account. Other headers are standard.

1. Request a code

POST /fieldservicegateway/usermanagement/v3/auth/forgot-password/init

Field	Type	Required	Description
email	string	yes	Account email

{
  "email": "user@example.com"
}

curl --request POST 'https://[BASE_URL]/fieldservicegateway/usermanagement/v3/auth/forgot-password/init' \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: {{x-api-key}}' \
  --header 'Authorization: {{Authorization}}' \
  --header 'Asurion-correlationid: correlation-id' \
  --header 'Asurion-enduser: end-user' \
  --header 'Asurion-sourcesystem: source-system' \
  --header 'Asurion-serviceprovider: company-id' \
  --header 'Asurion-client: default' \
  --data '{
    "email": "user@example.com"
  }'

200 OK. The same success body is returned when the email is unknown, so the call does not reveal whether an account exists.

{
  "success": true,
  "data": {
    "flow_id": "flow-id",
    "message": "If an account exists, a verification code has been sent."
  }
}

2. Check the code

POST /fieldservicegateway/usermanagement/v3/auth/forgot-password/verify

Field	Type	Required	Description
flow_id	string	yes	flow_id from step 1
code	string	yes	Code sent to the user. Up to 32 characters

{
  "flow_id": "flow-id",
  "code": "123456"
}

curl --request POST 'https://[BASE_URL]/fieldservicegateway/usermanagement/v3/auth/forgot-password/verify' \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: {{x-api-key}}' \
  --header 'Authorization: {{Authorization}}' \
  --header 'Asurion-correlationid: correlation-id' \
  --header 'Asurion-enduser: end-user' \
  --header 'Asurion-sourcesystem: source-system' \
  --header 'Asurion-serviceprovider: company-id' \
  --header 'Asurion-client: default' \
  --data '{
    "flow_id": "flow-id",
    "code": "123456"
  }'

200 OK

{
  "success": true,
  "data": {
    "reset_token": "reset-token",
    "expires_in": 1800,
    "message": "Code verified. You may now set a new password."
  }
}

Use reset_token in step 3. It expires after expires_in seconds.

3. Set a new password

POST /fieldservicegateway/usermanagement/v3/auth/forgot-password/reset

Field	Type	Required	Description
reset_token	string	yes	Token from step 2
password	string	yes	10–72 characters, with an uppercase letter, a lowercase letter, a digit, and a symbol. No spaces

{
  "reset_token": "reset-token",
  "password": "New-Passw0rd!"
}

curl --request POST 'https://[BASE_URL]/fieldservicegateway/usermanagement/v3/auth/forgot-password/reset' \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: {{x-api-key}}' \
  --header 'Authorization: {{Authorization}}' \
  --header 'Asurion-correlationid: correlation-id' \
  --header 'Asurion-enduser: end-user' \
  --header 'Asurion-sourcesystem: source-system' \
  --header 'Asurion-serviceprovider: company-id' \
  --header 'Asurion-client: default' \
  --data '{
    "reset_token": "reset-token",
    "password": "New-Passw0rd!"
  }'

200 OK

{
  "success": true,
  "data": {
    "message": "Password updated successfully."
  }
}

Errors

Status	Code	When
400	VALIDATION_ERROR	A required field is missing, or the new password does not meet the rules
400	SSO_ONLY_ACCOUNT	The email uses single sign-on and cannot reset a password here
403	ENDUSER_FLOW_MISMATCH	Asurion-enduser does not match the account that owns the code
500	INTERNAL_ERROR	Something unexpected failed

{
  "success": false,
  "error": "Forgot password is not available for SSO accounts",
  "code": "SSO_ONLY_ACCOUNT",
  "details": {
    "fields": []
  },
  "correlationId": "correlation-id",
  "timestamp": "2026-10-16T00:00:00.000Z"
}