Initiate a password-reset flow.
Always returns 202, regardless of whether the email is
registered — AuthService.request_password_reset runs the
rate-limit checks identically on both branches and only
sends the reset email when a real (non-soft-deleted) account
matches. No body, no Set-Cookie; the email itself carries the
next step.
Documentation Index
Fetch the complete documentation index at: https://docs.roughy.ai/llms.txt
Use this file to discover all available pages before exploring further.
Initiate a password-reset flow for email.
Endpoint always returns 202 regardless of whether the email is registered, so an attacker cannot enumerate accounts. Rate-limit runs identically on both branches.
Successful Response