---
title: "Execute password reset"
type: reference
method: POST
path: /rest-api/resetPasswordExec.do
tag: "Users"
---

# Execute password reset

`POST https://YOUR-NETWORK-DOMAIN/rest-api/resetPasswordExec.do`

Step 2 of the password reset flow. After the user receives a reset email (via /rest-api/forgot), they submit the single-use token from the email link along with their new password. The token is redeemed atomically, so a link works exactly once and only until it expires. The new password is checked against the platform password policy. No authentication is required for this endpoint.

## Form params

| Name | Type | Required | Example | Description |
|---|---|---|---|---|
| `token` | string | yes | `hT7kQ2mXo0pR4vZbN1cLdE8yUwA6sJfG3iK9nB5tQxM` | Single-use token from the password reset email link. |
| `newPass` | string | yes | `correct-horse-battery-staple` | The new password to set for the user account. |

## Responses

- `200` — Successful operation
- `400` — Bad request — invalid or missing parameters

## Example request

```bash
curl --request POST \
  --url 'https://YOUR-NETWORK-DOMAIN/rest-api/resetPasswordExec.do' \
  --header 'X-Api-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'token=hT7kQ2mXo0pR4vZbN1cLdE8yUwA6sJfG3iK9nB5tQxM' \
  --data-urlencode 'newPass=correct-horse-battery-staple'
```

Source: https://epom.com/ad-server/docs/api/users/post-resetpasswordexec