Sign in

v1

latestOpenAPI 3.0.02026-07-2417129274.8 KB
Customer Actions

Reset Password Request

Reset password API is a synchronous POST-method API call.

It allows Riskified to understand whether an account has been secured following an incident (if not it needs to be treated as a 'compromised' account). It also enables measuring account recovery rate - an important KPI for both Riskified and the merchants.

When to trigger:

  • When a password-reset action has been requested
  • When the request has been processed

Response: decision is always allow.

post/reset_password

Headers

x-riskified-shop-domainstring required
Example:merchant.example.com

The merchant shop domain registered with Riskified.

x-riskified-hmac-sha256string required
Example:b1946ac92492d2347c6235b4d2611184

Verification hash for the Request. Generated by performing an SHA256 encryption on the request's POST body and calculating the HMAC hash of the result using your Riskified authentication token. Please use UTF8 encoding.

content_type'application/json' required

As payloads are sent to Riskified in JSON format, value should be: application/json

accept'application/vnd.riskified.com; version=2' required

Specify the version of the API to target. For example, to target the latest version of the API, use the following: application/vnd.riskified.com; version=2

Request body

customer_idstring required

A unique numeric identifier for the customer.

emailstring required

The email address on the registered customer account.

status'pending' | 'success' | 'failed' required

Indicates the status of the request.

Possible values:

  • pending: Password reset has been requested but new password has not been set
  • success: Password has successfully been reset and old password is no longer valid
  • failed: Password failed to be reset and old password is still valid
reason'user_requested' | 'forgot_password' | 'forced_reset' required

The reason for the password reset request.

Possible values:

  • user_requested: Customer is logged in and initiates a password change from their account
  • forgot_password: Customer has forgotten password and directly initiates process to create a new password
  • forced_reset: An internal system-initiated password reset request
vendor_namestring

The name of the affiliated partner or selling vendor.

Example request

{
  "customer_id": "207119551",
  "email": "bob.norman@hostmail.com",
  "client_details": {
    "accept_language": "en-CA",
    "user_agent": "Mozilla/5.0 (CFNetwork/548.0.3 Darwin/11.2.0)"
  },
  "session_details": {
    "cart_token": "68778783ad298f1c80c3bafcddeea02f",
    "browser_ip": "111.111.111.111",
    "created_at": "2025-11-18T11:00:00-05:00",
    "source": "mobile_app",
    "device_id": "01234567-89ABCDEF-01234567-89ABCDEF",
    "referring_site": "http://www.nba.com/"
  }
}

Response

Successful operation

decision'allow' required

The decision made by Riskified regarding the reset password attempt.