README — POST /api/admin/admins/{sub}/password-reset
POST /api/admin/admins/{sub}/password-reset
(no self-service recovery). Revokes that admin's sessions and has Cognito email a new temporary password. Refused on
yourself. Audited admin.password_reset.
Caller and authorization
Request contract
| Location | Name | Required | Meaning |
|---|---|---|---|
| path | sub | Yes | Use the ID from an authorized staff response; source validators reject malformed IDs. |
| header | X-Admin-CSRF | Yes | Session-bound token from the staff page; not a developer credential. |
Response and failures
(no self-service recovery). Revokes that admin's sessions and has Cognito email a new temporary password. Refused on
yourself. Audited admin.password_reset.
{error:{code,message}} for CloudError failures, attaches Request-Id, and disables caching. Handle 401 by signing in; show role refusal for 403 forbidden, reauthenticate only for step_up_required, and collect a reason for 400 reason_required. A CSRF failure needs a current page/session token, not blind retries. Operation-specific 404/409/413/422/502/503 errors retain their status. Honor Retry-After on 429.Implementation contract
/**
* POST /api/admin/admins/:sub/password-reset (admins.disable: owners, step-up): the staff pool's only password reset
* (no self-service recovery). Revokes that admin's sessions and has Cognito email a new temporary password. Refused on
* yourself. Audited admin.password_reset.
*/
export const POST = adminRoute("admins.disable", async (_request, ctx, { params }: Context) => {
const { sub } = await params;
if (!/^[\w.-]{1,128}$/.test(sub)) throw new CloudError(404, "not_found", "Admin not found.");
return adminJson(await resetStaffPassword(ctx, sub));
});Modified at 2026-10-26 13:41:16