Restore Password

The POST /v2/restorePassword endpoint allows users to securely reset their password by providing a verification code along with a new password. This endpoint is the second step in the forgot-password flow: after requesting a reset code, the user submits that code together with their nickname and the desired new password. The password change takes effect immediately upon success.

Endpoint

POST /v2/restorePassword

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when a user has forgotten their password and has already initiated the forgot-password flow to receive a reset code. Submit the reset code along with the user's nickname and the new password to complete the password update. This is also appropriate when a partner application needs to facilitate a secure credential reset on behalf of a user.

Request Body

{
  "nickName": "johndoe",
  "code": "847291",
  "password": "NewSecure@Pass1!",
  "passwordConfirm": "NewSecure@Pass1!"
}

Response

200 OK

{
  "restoreState": "Success",
  "errors": null,
  "success": "Password has been successfully updated."
}

Error Codes

Common Mistakes

• Submitting a code that has expired or was already used — always request a fresh code if the previous one is no longer valid.
• Providing a password that does not match passwordConfirm — both fields must be identical character for character.
• Using a weak password that does not meet complexity requirements (minimum length, mix of letters, numbers, and symbols).
• Omitting nickName — this field is required even though it may seem redundant after the forgot-password request step.

Related Endpoints

• POST /v2/forgotPassword — Initiates the password reset flow and sends a verification code to the user
• POST /api/auth/v2 — Authenticates a user and returns a Bearer token
• POST /api/auth/refresh — Refreshes an existing Bearer token before it expires

Example

curl -X POST https://api.banking.netevia.dev/v2/restorePassword \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "nickName": "johndoe",
    "code": "847291",
    "password": "NewSecure@Pass1!",
    "passwordConfirm": "NewSecure@Pass1!"
  }'