Forgot Password / Confirm Code

Overview

The current mobile API exposes endpoints to request and confirm an emailed recovery code for an existing account. It does not expose the final endpoint needed to set a new password, so this is not currently a complete self-service password-reset flow.

Password Reset Flow

The exposed mobile contract has two stages:

1. Request a reset code — provide your registered email address.
2. Enter the confirmation code — enter the code received in your email.

Stage 1 — Request a Reset Code

1. Send POST /api/Researcher/forgot-password.
2. Include the optional lang header and JSON body { "email": "user@example.com" }.
3. The endpoint is anonymous and uses the PasswordReset rate-limit policy.

If the account is found, Survanta stores a generated code on that account and attempts to email it. The current service can return a distinct "user not found" result, so clients should avoid amplifying this difference in their user interface.

Check the inbox and Spam or Junk folder for the message. The current implementation does not persist or enforce a recovery-code expiry timestamp.

Stage 2 — Enter the Confirmation Code

1. Send POST /api/Researcher/confirm-code.
2. Include the optional lang header and JSON body { "email": "user@example.com", "code": "..." }.
3. The endpoint is anonymous and uses the PasswordReset rate-limit policy.

If the code exactly matches the value stored on the account, the endpoint confirms unconfirmed email/phone flags and returns a JWT plus user details. If the code is wrong:

• Check that you copied the code exactly, with no extra spaces.
• Requesting another code through the forgot-password endpoint replaces the stored value.
• Rate limiting can return HTTP 429; no separate resend route or documented attempt counter is exposed.

Password Change Limitation

No mobile API route currently accepts the confirmed code and a new password. Confirming the code does not change the password. Contact the organization's administrator or use another supported account-management surface to perform the password change.

Signing In With Your New Password

After an administrator or another supported account-management surface changes the password:

1. Return to the login screen.
2. Enter your email address and the new password you just set.
3. Tap Sign In.

Security Notes

• Do not describe the current code as expiring or single-use: confirmation does not clear the stored value and no expiry timestamp is checked by these endpoints.
• If you did not request a password reset and receive a reset email, ignore it. Your password has not been changed. Consider notifying your administrator if you suspect unauthorized activity.
• The endpoints are rate-limited, but the service does not expose a separate failed-code lockout contract.
• If you cannot access your registered email address, contact your organization's Survanta administrator to reset your password manually.