> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nexudus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Complete Password Reset

> Set a new password for a customer account using the token received in the password-reset email.

# Complete Password Reset

Validates the one-time reset token sent to the customer's email and sets the new password. On success, Nexudus returns a JWT that the portal immediately exchanges for a bearer token, signing the customer in automatically without an extra login step.

## Authentication

No authentication required. The `token` in the request body acts as the credential.

## Request Body

<ParamField body="Token" type="string" required>
  The one-time reset token extracted from the password-reset link sent to the customer's email. This token is single-use and expires after a short
  period.
</ParamField>

<ParamField body="Password" type="string" required>
  The new password the customer wants to set. Must satisfy the location's password policy.
</ParamField>

<ParamField body="BusinessId" type="number" required>
  The numeric ID of the business/location. Obtained from the current location context.
</ParamField>

## Response

Returns an `ActionConfirmation` envelope. On success, `Value` contains a JWT that can be exchanged for a bearer token via `POST /api/sys/users/exchange`.

<ResponseField name="WasSuccessful" type="boolean">
  `true` when the password was changed successfully.
</ResponseField>

<ResponseField name="Value" type="string | null">
  One-time JWT to exchange for a bearer token via `POST /api/sys/users/exchange`. Pass this directly to `endpoints.system.auth.login(Value)`.
</ResponseField>

<ResponseField name="Status" type="number">
  HTTP-style status code mirrored in the body. `200` on success.
</ResponseField>

<ResponseField name="Message" type="string | null">
  Human-readable message or error description.
</ResponseField>

<ResponseField name="Errors" type="any">
  Validation errors object. `null` on success.
</ResponseField>

## Example Response

```json theme={null}
{
  "WasSuccessful": true,
  "Value": "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiI0MiIsImV4cCI6MTcw...",
  "Status": 200,
  "Message": null,
  "Errors": null
}
```

## TypeScript Integration

```typescript theme={null}
import endpoints from '@/api/endpoints'
import { ActionConfirmation } from '@/types/ActionConfirmation'

const url = endpoints.system.users.completePasswordReset
// => '/api/sys/users/completePasswordReset'

const response = await httpClient.post<ActionConfirmation>(url, {
  Token: resetToken,
  Password: newPassword,
  BusinessId: business.Id,
})

if (response.data.WasSuccessful && response.data.Value) {
  // Exchange the JWT for a bearer token and sign the customer in
  const exchangeUrl = endpoints.system.auth.login(response.data.Value)
  await httpClient.post(exchangeUrl)
}
```

## Usage in Portal

| Context                    | Source file                     |
| -------------------------- | ------------------------------- |
| Reset password page / flow | `src/views/auth/ResetPassword/` |

## Error Responses

<ResponseField name="400 Bad Request" type="error">
  The token is invalid, expired, or already used. The customer must restart the password-reset flow via `POST /api/sys/users/startPasswordReset`.
</ResponseField>

<ResponseField name="400 Bad Request — password policy" type="error">
  The new password does not meet the location's password requirements. Check `Errors` in the response body.
</ResponseField>

## Related Endpoints

| Method | Endpoint                            | Description                                  |
| ------ | ----------------------------------- | -------------------------------------------- |
| `POST` | `/api/sys/users/startPasswordReset` | Trigger the password-reset email             |
| `POST` | `/api/sys/users/exchange`           | Exchange the returned JWT for a bearer token |
| `POST` | `/api/token`                        | Standard credential-based sign-in            |