Web service API

How to use PageSeeder's Web service API

reset password group

/groups/{group}/members/resetpassword [POST]

com.pageseeder.member.ResetPassword

Description

Reset password for a member.

Workflow

In order to identify the member, either the username or email address is required.

The reset password is done in two steps:

  1. The system sends an email asking for confirmation of reset password (with a key/token) to the user.
  2. The user then confirms the request by sending the key/token to the system. If everything matches, a new password is set and a notification email sent to the user to confirm the password update.

This service can be used for both steps.

  • If no key or token parameter is specified, this service sends one by email to the member.
  • Otherwise, when the request includes either a key or a token parameter, this service attempts to update the password as specified in the member-password parameter.

Email

If the group defines specific email templates, the emails sent will use the group's style.

To customize the email templates, you need to create the following email templates:

TemplateDescription
reset-password-confirmEmail containing instructions on how to reset the password including a link with a valid reset password token
change-passwordConfirmation email sent after the password

For more details, see the reset password email flow.

To use the default PageSeeder email templates, you can also simply use the /members/resetpassword  service.

Security considerations

If the password is successfully updated via a valid token or key, the member is automatically unlocked.

Members that are bound to an API account cannot have their password reset through this method.

Parameters

NameDescriptionRequiredTypeDefault value
email The member's email yes, if no username email
key The reset password key - DEPRECATED use token instead. no string
member-password The member's new password no string
member-username The member's username yes, if no email string
token The reset password token no string

 

Permission

This service is public: anybody can invoke it.

Response

When no key/token is specified and member-password not specified, then an email confirming the reset password request is sent to the member (step 1) and the XML output is:

 <reset-password status="request-successful" />

If member-password is specified and the member has the correct confirmation key/token , then the new password is set, notification is emailed to the member and the XML output is:

 <reset-password status="password-changed" />

If member-password="" or not specified and the member has the correct confirmation key, then whether the user is an admin is returned in the XML output for password strength:

 <reset-password status="pending" [admin="true"] />

When the user was not found then the XML output is the same as the first step (so that an external user does not know if a username/email exists in the system):

 <reset-password status="request-successful" />

Error handling

CodeCause / Description
0x1008 If the email and username are empty (for admins only).
0x1002 If the email address is invalid.
0x100E If no member was found (for admins only).
0x1018 If the member is an API account
0x1019 If the account is locked
0x100F If the member has no email address
0x1024 If the reset password key is invalid

Created on , last edited on