Password Reset API

Table of Contents

The password reset API consists in 2 mandatory and 1 optional step. The mandatory steps are the initiation of the password reset request and its confirmation. The optional step is to check the status of a previously submitted request. 

Password Reset Initial Request

Current Implementation

This operation is meant to be used when a user wants to reset his/her password and/or pin because he/her has forgot it.

This operation performs the following actions:

1. Creates a token with a short lifespan (10 minutes).
2. Creates an entry in a PasswordResetRequest table associating the token and the email of the user that is initiating the request. This association prevents any valid token (other than the one that was specifically created for this purpose) to reset a user's password and/or pin. 
3. Optionally emails the user a link that can be used to reset his/her password. (the link contains the generated token and the email of the user)

The output of this operation is:

1. A 'success' status of 'false' and a corresponding 'failMessage' if:
   1. The provided email doesn't exist.
   2. There is some internal error in the operation.
2. A 'success' status of 'true' if the operation was successfully completed in addition of the following information:
   1. token: The generated token in case it is needed by the client.
   2. resetURL: The original URL sent by the client but with any additional information added by the server (like the placeholder replaced with the correct token).

Parameters

Base URL: /passwordReset/init
Parameters:

API Sample

Happy Path

http://192.168.1.126:8080/PresentationServices/passwordReset/init?email=e@e.com&resetURL=http%3A%2F%2F127.0.0.1%3A8888%2Fportal.html%3Fpage%3Dreset%26resettoken%3D%7Btoken%7D

{
data: {
token: "19c65444-324a-4449-a8de-706ebe9cf8a9",
resetURL: "http://127.0.0.1:8888/portal.html?page=reset&resettoken=19c65444-324a-4449-a8de-706ebe9cf8a9"
},
statusFact: {
success: true
}
}

Non existing email

http://192.168.1.126:8080/PresentationServices/passwordReset/init?email=non-existing@e.com&resetURL=http%3A%2F%2F127.0.0.1%3A8888%2Fportal.html%3Fpage%3Dreset%26resettoken%3D%7Btoken%7D

{
statusFact: {
failMessage: "Unknown user for provided email",
success: false
}
}

Password Reset Request Status

Current Implementation

This operation checks whether a particular user has a pending 'password/pin reset' operation.

This operation performs the following actions:

1. Check if an entry in PasswordResetRequest table exists for a provided email and token.

The output of this operation is:

1. A 'success' status of 'false' and a corresponding 'failMessage' if:
   1. There is some internal error in the operation
2. A 'success' status of 'true' if the operation was successfully completed in addition to the following information:
   1. pending: boolean value specifying whether a pending operation exits or not.

Parameters

Base URL: /passwordReset/status
Parameters:

API Sample

Happy Path

http://192.168.1.126:8080/PresentationServices/passwordReset/status?email=e@e.com&token=93254c85-be0d-4eed-9d17-e6aada743c5f

{
data: {
pending: true
},
statusFact: {
success: true
}
}

Non-existing email/pending operation/wrong token

http://192.168.1.126:8080/PresentationServices/passwordReset/status?email=e@e.com&token=93254c85-be0d-4eed-9d17-e6aada743c5f

{
data: {
pending: false
},
statusFact: {
success: true
}
}

Password Reset Request Confirmation

Current Implementation

This operation modified the pin and/or password of a user.

This is a POST operation.

This operation performs the following actions:

1. Modifies pin and/or password of a user.
2. Remove the entry of PasswordResetRequest table associated to this operation.

The output of this operation is:

1. A 'success' status of 'false' if:
   1. There is not entry for the provided token in PasswordResetRequest.
   2. If the provided email and token don't match the existing PasswordResetRequest entry.
   3. There is some internal error in the operation.
2. A 'success' status of 'true' if the operation was successfully completed.

After this operation is successfully completed, the corresponding PasswordResetRequest entry is eliminated from the database.

Parameters

Base URL: /passwordReset/confirm
Parameters:

API Sample

http://192.168.1.126:8080/PresentationServices/passwordReset/confirm?email=e@e.com&token=573e3b16-8acb-462a-8713-3aa63fda7395&password=newPass&pin=newPin

{
"statusFact":{
"success":true
}
}