# Password

Password management endpoints for changing and recovering account passwords. Supports two flows: authenticated password change (requires current password and email confirmation) and unauthenticated password recovery (sends reset code to account email). All password changes invalidate other active sessions for security.

## Confirm and apply password change

 - [POST /api/v1/accounts/password/change/confirm](https://docs.wellesley.social/openapi/password/paths/~1api~1v1~1accounts~1password~1change~1confirm/post.md): Step 2 of authenticated password change: verifies the email confirmation code and applies the new password. Sends a confirmation email and invalidates all other active sessions. Requires authentication.

## Request password change

 - [POST /api/v1/accounts/password/change/request](https://docs.wellesley.social/openapi/password/paths/~1api~1v1~1accounts~1password~1change~1request/post.md): Step 1 of authenticated password change: validates the current password and stores the new password temporarily. Sends a confirmation code to the account email. Requires authentication and a valid current password.

## Resend password change confirmation code

 - [PUT /api/v1/accounts/password/change/resend-code](https://docs.wellesley.social/openapi/password/paths/~1api~1v1~1accounts~1password~1change~1resend-code/put.md): Resends the confirmation code for an in-progress password change to the account email. Use when the original code was not received or expired. Requires authentication. Rate limited to prevent abuse.

## Request password recovery

 - [POST /api/v1/accounts/password/recover](https://docs.wellesley.social/openapi/password/paths/~1api~1v1~1accounts~1password~1recover/post.md): Step 1 of password recovery for unauthenticated users: sends a recovery code to the account email. Accepts either email or username as the login identifier. Must NOT be authenticated - returns error if called with an active session. Rate limited to prevent abuse.

## Set new password after recovery

 - [POST /api/v1/accounts/password/recover/change](https://docs.wellesley.social/openapi/password/paths/~1api~1v1~1accounts~1password~1recover~1change/post.md): Step 3 of password recovery: sets the new password for an unauthenticated user. Requires that the recovery code was previously validated via /recover/check-code. Sends a confirmation email and invalidates all existing sessions. Must NOT be authenticated - returns error if called with an active session.

## Validate password recovery code

 - [POST /api/v1/accounts/password/recover/check-code](https://docs.wellesley.social/openapi/password/paths/~1api~1v1~1accounts~1password~1recover~1check-code/post.md): Step 2 of password recovery: validates the recovery code sent to email. On success, stores a temporary flag allowing the password to be changed in the next step. Must NOT be authenticated - returns error if called with an active session.