Skip to content
Ele API

Complete a password reset

POST
/api/v1/auth/password-reset/complete
curl --request POST \
  --url https://api.elephants.inc/api/v1/auth/password-reset/complete \
  --header 'Content-Type: application/json' \
  --data '{ "password": "example", "password_confirmation": "example", "token": "example" }'

Verifies the reset token, updates the password, and invalidates all sessions.

Request Bodyrequired

Section titled “Request Bodyrequired”

Reset token and new password

Media typeapplication/json
CompletePasswordResetParams
object
password
required
string
<= 128 characters
password_confirmation
required
string
<= 128 characters
token
required
string
<= 1024 characters

Example generated

{
  "password": "example",
  "password_confirmation": "example",
  "token": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Password reset completed

Media typeapplication/json
PasswordResetResponse
object
message
required
string

Example generated

{
  "message": "example"
}

400

Section titled “400”

Invalid request parameters or body

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
  "error": {
    "details": "example",
    "message": "example",
    "request_id": "example",
    "step_up": {
      "delivery": "example",
      "expires_at": "2026-04-15T12:00:00Z",
      "id": "example",
      "match_code": "example",
      "methods": [
        "example"
      ],
      "step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "webauthn": {
        "allow_credentials": [
          {
            "id": "example",
            "transports": [
              "example"
            ],
            "type": "example"
          }
        ],
        "challenge": "example",
        "challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "rp_id": "example",
        "timeout": 1,
        "user_verification": "example"
      }
    },
    "type": "example"
  }
}

422

Section titled “422”

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
  "error": {
    "details": "example",
    "message": "example",
    "request_id": "example",
    "step_up": {
      "delivery": "example",
      "expires_at": "2026-04-15T12:00:00Z",
      "id": "example",
      "match_code": "example",
      "methods": [
        "example"
      ],
      "step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "webauthn": {
        "allow_credentials": [
          {
            "id": "example",
            "transports": [
              "example"
            ],
            "type": "example"
          }
        ],
        "challenge": "example",
        "challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "rp_id": "example",
        "timeout": 1,
        "user_verification": "example"
      }
    },
    "type": "example"
  }
}

429

Section titled “429”

Too many requests

Media typeapplication/json
RateLimitedError
object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string
error
required
object
type
required
string
Allowed value: rate_limited

Example 

{
  "error": {
    "type": "rate_limited"
  }
}

Headers

Section titled “Headers”
Retry-After
required
string

How long to wait before retrying, expressed as delay seconds or an HTTP date

500

Section titled “500”

Unexpected server error

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
  "error": {
    "details": "example",
    "message": "example",
    "request_id": "example",
    "step_up": {
      "delivery": "example",
      "expires_at": "2026-04-15T12:00:00Z",
      "id": "example",
      "match_code": "example",
      "methods": [
        "example"
      ],
      "step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "webauthn": {
        "allow_credentials": [
          {
            "id": "example",
            "transports": [
              "example"
            ],
            "type": "example"
          }
        ],
        "challenge": "example",
        "challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "rp_id": "example",
        "timeout": 1,
        "user_verification": "example"
      }
    },
    "type": "example"
  }
}