/api/v1/auth/password/forgot

Public. Always 204, whether or not an account matches, and the mail goes out in the background, so neither the answer nor its timing tells whether an account exists. A login with @ is an address and reaches every account whose confirmed address it is; otherwise it is a username with a confirmed address. An account without a password that signs in through the identity provider gets a hint instead. The owner is never reset by mail; at most one mail per account per 5 minutes.

curl -X POST "https://example.com/api/v1/auth/password/forgot" \  -H "Content-Type: application/json" \  -d '{    "login": "string"  }'