# IRPCLoginsAdmin.ResetPassword

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md) > [Server login accounts](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ResetPassword/

Badges: `Administration API / specialized` `admin` `no session`

Completes the "forgot password" flow: sets a new password for a login with the values from the
password reset link.

- **Service:** [Server login accounts](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/index.md) `MFiles.IRPCLoginsAdmin`
- **gRPC method:** `/MFiles.IRPCLoginsAdmin/ResetPassword`
- **HTTP (mf-http-grpc):** `POST /grpc/v1/reset-password`
- **Request:** [`ResetPasswordRequest`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ResetPassword/index.md#request)
- **Response:** [`ResetPasswordResponse`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ResetPassword/index.md#response)
- **Book and level:** Administration API, specialized
- **Kind:** admin
- **Session:** Not needed: the call can be made before logging in.
- **Idempotent:** no
- **Returns metadata structure version:** no
- **Streaming:** none (unary)

<a id="remarks"></a>

## Remarks

- Needs no session. The `account_name`, `expiration_time` and `reset_password_hash` come from
  the link's `username`, `expiration` and `hash` query parameters
  ([CreatePasswordResetRequest](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/CreatePasswordResetRequest/index.md)).
- An invalid or expired link fails with "Changing the password failed.".
- Failed attempts count toward the server's login attack protection, like failed logins; a
  blocked address or account fails until the block ends.
- **Pitfall:** set `password_format` to `PASSWORD_FORMAT_SEE_OTHER_PARAMS`. The proto3 default
  selects a deprecated format that overrides the other password fields.

<a id="request"></a>

## Request: ResetPasswordRequest

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page.

| Field | Type | Description |
|---|---|---|
| `account_name` | `string` | The name of the login account whose password should be reset. |
| `expiration_time` | `string` | The time when this password request expires. |
| `reset_password_hash` | `string` | The hash used to confirm that this is a valid password reset. |
| `new_password` | `string` | The new password for the login account. |
| `vault_guid` | `string` | Optional vault for servers that use vault login accounts. |
| `password_format` | [`PasswordFormat`](https://developer.m-files.com/APIs/gRPC-API/Reference/Enums/MFiles.PasswordFormat/index.md) | Set `PASSWORD_FORMAT_SEE_OTHER_PARAMS`. The other values, including the default, are deprecated. Values: `PASSWORD_FORMAT_MD5_HASH_ENCRYPTED` (0), `PASSWORD_FORMAT_PLAIN_TEXT` (1), `PASSWORD_FORMAT_SEE_OTHER_PARAMS` (2). |
| `password_encryption` | [`PasswordEncryption`](https://developer.m-files.com/APIs/gRPC-API/Reference/Enums/MFiles.PasswordEncryption/index.md) | Encryption used for the passwords in transit. Values: `PASSWORD_ENCRYPTION_RC4` (0), `PASSWORD_ENCRYPTION_UNENCRYPTED` (1), `PASSWORD_ENCRYPTION_AES256` (2). |
| `password_unhashed` | `bool` | True if `new_password` is the password itself (possibly encrypted), not a hash. If false, the hash must use `password_hash_algorithm_desired`. |
| `password_hash_algorithm_desired` | [`PasswordHashAlgorithm`](https://developer.m-files.com/APIs/gRPC-API/Reference/Enums/MFiles.PasswordHashAlgorithm/index.md) | Algorithm to be used to hash the new password in the database. Values: `PASSWORD_HASH_ALGORITHM_MD5` (0), `PASSWORD_HASH_ALGORITHM_UNDEFINED` (1), `PASSWORD_HASH_ALGORITHM_PBKDF2_WITH_SHA512_AND100000_ITERS` (2). |
| `new_password_salt` | `string` | The salt of a hashed `new_password`. Ignored when `password_unhashed` is true; the server then generates the salt. |

<a id="response"></a>

## Response: ResetPasswordResponse

No fields.

<a id="related"></a>

## Related methods

- [CreatePasswordResetRequest](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/CreatePasswordResetRequest/index.md): Starts the "forgot password" flow for an M-Files login: sends the user an e-mail with a password reset link.