> ## Documentation Index
> Fetch the complete documentation index at: https://docs.symbiosis.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# Email a single-use password reset link.

> Always returns 204 so the endpoint cannot confirm whether an address is registered.



## OpenAPI

````yaml /openapi.yaml post /auth/password/forgot
openapi: 3.1.0
info:
  title: Symbiosis API
  description: >-
    The Symbiosis REST API.


    ## Authentication


    Endpoints accept one of two credentials:


    - **Session token**: `Authorization: Bearer <token>`, from `POST
    /auth/login`.

    - **API key (HMAC)**: three headers on every request:
      - `APIKEY`: the API key id, from `POST /auth/api-keys`.
      - `X-Hmac-Timestamp`: current Unix time in milliseconds.
      - `X-Hmac-Signature`: Base64-encoded HMAC-SHA256 of
        `timestamp_ms "\n" METHOD "\n" PATH_AND_QUERY "\n" BODY`, keyed with the API key
        secret. `PATH_AND_QUERY` is the full request target including the query string.

    ## Wire formats


    Token and USDC amounts (`U256`) have 6 decimals, so 5000000 is 5 outcome
    tokens or 5 USDC. Responses encode them as 0x-prefixed hex; requests accept
    decimal strings, 0x-prefixed hex, or JSON numbers. Asset ids and addresses
    are 0x-prefixed hex. Prices are USDC per token, scaled by 1e6. A trade's
    USDC notional is floor(price × amount / 1000000). Fee rates are basis
    points.


    ## Request ids


    Every response carries an `x-request-id` header: a server-minted UUID that
    keys our logs. Include it when reporting a problem. The server never adopts
    an id you send; an inbound `x-request-id` is logged alongside ours, so a
    request that never got a response can still be found.


    ## Identifiers and uniqueness


    For integrators mirroring this API into their own storage:


    - **Globally unique, never reused**: `user_id`, `api_key_id`, `request_id`,
    `quote_id`, `match_id`, `withdrawal_id`, `job_id`, audit event `id`. The
    ledger's `entry_id` is also strictly increasing: a safe dedupe key and
    cursor.

    - **Unique per user**: `client_withdrawal_id`, the caller-chosen idempotency
    key. Replaying the same id and terms returns the original withdrawal; the
    same id with different terms returns 409.

    - **Composite keys**: an outcome token is `(venue, asset_id)`, never
    `asset_id` alone; balances are keyed by `(user, venue, asset_id)`, with USDC
    held separately.

    - **Not unique**: a ledger `ref_id` (all entries caused by the same record
    share it) and a withdrawal's `transaction_hash` (it can change if the job is
    re-signed; key on `job_id`).
  version: 0.1.0
servers:
  - url: https://api.symbiosis.markets
security: []
tags:
  - name: auth
    description: Accounts, sessions, API keys, and websocket tickets.
  - name: custody
    description: Deposit addresses, balances, and withdrawals.
  - name: rfq
    description: Quote requests, quotes, and matching.
paths:
  /auth/password/forgot:
    post:
      tags:
        - auth
      summary: Email a single-use password reset link.
      description: >-
        Always returns 204 so the endpoint cannot confirm whether an address is
        registered.
      operationId: forgot_password
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ForgotPasswordRequest'
        required: true
      responses:
        '204':
          description: no content
components:
  schemas:
    ForgotPasswordRequest:
      type: object
      properties:
        email:
          type: string
      required:
        - email

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.