Create Out-of-Band Code

Generate a password reset out-of-band (OOB) code and URL for a user. Requires ADMIN permissions and the PEOPLE_MANAGEMENT feature flag. The user must have linked authentication and an email address. This endpoint returns the reset details without sending a reset email.

Parameters

name * are required parameters	data type	description
userId*	string	The unique identifier of the user

No request body is required. Generating a code updates the global user's password reset timestamp and starts the shared three-minute cooldown for this endpoint and /api/password-reset.

Return Value

Returns HTTP 201 Created.

{
  "message": "Successfully updated the users permissions",
  "data": {
    "code": "reset-code",
    "url": "https://app.wombat.software/password-reset-form?oobCode=reset-code"
  }
}

Error Codes

• 400 Bad Request: This user is managed externally when the user has no linked authentication.
• 400 Bad Request: User email is not available when the user has no email address.
• 400 Bad Request: Email address not found when the email has no Firebase Authentication account.
• 400 Bad Request: User record not found when the authentication account exists but its global user record is missing. No code is generated or password reset timestamp updated.
• 400 Bad Request: A reset was requested less than three minutes ago. Wait until the cooldown has elapsed before retrying.
• 401 Unauthorized: Returned when permissions are insufficient.
• 500 Internal Server Error: failed to generate reset code when the generated reset link contains no OOB code.

Examples

bash

curl -X POST "https://app.wombat.software/api/{targetPath}/user/:userId/create-oob" \
  -H "Authorization: Bearer ..."