Initiate Forgot Passkey

POST 
/identity/v2/auth/passkey/forgot

Initiates the forgot Passkey process for a User. When the tenant has the IsGenericError setting enabled (the default for new apps), this endpoint responds with 200 {"IsPosted": true} for a well-formed email address that has no account, so that the response cannot be used to enumerate registered users.

Request

Responses

200

Successfully submit request to reset the Passkey. When the tenant has IsGenericError enabled this status is also returned for an unknown account, so it does not imply that an account exists for the submitted email address.

400

Bad Request - the request is malformed or invalid.

401

Status Unauthorized: The request requires User authentication.

403

Forbidden - the client is not allowed to access this resource. USER_NOT_EXISTS (938) is returned only when the tenant has the IsGenericError setting disabled; with it enabled that case returns 200 {"IsPosted": true} instead. USER_ID_BLOCKED (991) is returned regardless of the setting.

429

Too Many Requests: The client has sent too many requests in a given amount of time.

Response Headers

X-RateLimit-Limit
Refill rate of the bucket that rejected this request: requests per second for the tenant bucket, or requests per refill window (60 seconds by default) for the per-IP bucket.
Example: 100
X-RateLimit-Remaining
Tokens left in that bucket.
Example: 0
X-RateLimit-Reset
Unix timestamp, in seconds, at which the next token becomes available. This is the earliest time a retry can succeed.
Example: 1757942400