Reset a password using a reset token
Public endpoint that completes the password-reset flow started by POST /password/forgot. Consumes the signed token emailed to the user and updates the password hash. Legacy alias: POST /reset-password. Note: the Password::PASSWORD_RESET success branch returns HTTP 200 with status=error due to a long-standing bug in the controller — preserved here for backwards compatibility; integrators should treat HTTP 200 as success regardless of the status field.
Body
Email + new password + reset token (as delivered in the reset link).
Email of the admin user resetting the password. Validator rule: required|email.
"user@example.com"
New password. Validator rule: required|Password::default() — must satisfy the framework default password policy (length / complexity).
"N3wPassword!"
Reset token from the password reset email. Validator rule: required.
"b13c6d4e0a8f..."
Optional confirmation field forwarded to the password broker; only required when the broker is configured to require it.
"N3wPassword!"