Reset the authenticated user's password to the supplied value, revokes all of their existing tokens, and returns a fresh access token.

Auth: Both — authentication, inside the users/ prefix of the authenticated group. Target is implicitly the caller: it operates on only (no id param, no company scoping), so any authenticated user resets their own password. Typically called with the short-lived token returned by verify/email/otp (type=forgot_password).

Rate limit: No rate limit.

Request

• Body:

Response — { data. } envelope.

• status (string) — success.
• response (string) — Password has been updated successfully.
• token (string) — a newly minted Passport access token.

Errors: 422 on validation failure.