How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Stytch Passwords API

The Passwords API from Stytch — 4 operation(s) for passwords.

Stytch Passwords API is one of 47 APIs that Stytch publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Passwords. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 4 operations across 4 paths, and defines 68 schemas. It is described by OpenAPI 3.2.0, at version 2.0.0.

Requests are made against 2 base URLs: https://api.stytch.com, https://test.stytch.com.

4 operations 4 paths 68 schemas 4 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
2.0.0
Base URL
https://api.stytch.com
Authentication
HTTP Basic
Contact
License
Proprietary
Resource Areas
1

Authentication & Security 1

Stytch Passwords API declares 1 security scheme for authenticating requests. It accepts HTTP basic authentication (basicAuth).

Paths & Operations 4

Across 4 paths, the API surfaces 4 operations — 4 POST. Each is listed below with its method, path, parameters, and response codes.

Passwords 4
POST
/v1/passwords/email/reset/start
Resetstart
api_password_v1_passwords_email_ResetStart body → 200400401429500
POST
/v1/passwords/email/reset
Reset
api_password_v1_passwords_email_Reset body → 200400401429500
POST
/v1/passwords/existing_password/reset
Reset
api_password_v1_passwords_existing_password_Reset body → 200400401429500
POST
/v1/passwords/session/reset
Reset
api_password_v1_passwords_session_Reset body → 200400401429500

Schemas 68

The contract defines 68 schemas that model the data the API accepts and returns. The most detailed are api_session_v1_AuthenticationFactor (46 properties), api_user_v1_User (19 properties), api_password_v1_passwords_email_ResetRequest (10 properties), api_session_v1_Session (9 properties). Each schema is shown below with its type and property counts.

api_session_v1_AuthenticationFactorDeliveryMethod
string
api_session_v1_OAuthAccessTokenExchangeFactor
object
1 property 1 required
api_user_v1_BiometricRegistration
object
2 properties 2 required
api_session_v1_InstagramOAuthFactor
object
3 properties 2 required
api_session_v1_SteamOAuthFactor
object
3 properties 2 required
api_session_v1_GitLabOAuthFactor
object
3 properties 2 required
api_session_v1_SAMLSSOFactor
object
3 properties 3 required
api_session_v1_LinkedInOAuthFactor
object
3 properties 2 required
api_session_v1_BitbucketOAuthFactor
object
3 properties 2 required
api_session_v1_ImpersonatedFactor
object
2 properties 2 required
api_password_v1_passwords_existing_password_ResetResponse
object
8 properties 6 required
api_session_v1_AppleOAuthFactor
object
3 properties 2 required
api_session_v1_GoogleOAuthExchangeFactor
object
1 property 1 required
api_session_v1_FigmaOAuthFactor
object
3 properties 2 required
api_session_v1_MicrosoftOAuthFactor
object
3 properties 2 required
api_user_v1_OAuthProvider
object
5 properties 5 required
api_session_v1_TwitchOAuthFactor
object
3 properties 2 required
api_session_v1_Session
object
9 properties 4 required
api_user_v1_User
object
19 properties 11 required
api_session_v1_HubspotOAuthFactor
object
3 properties 2 required
api_session_v1_ShopifyOAuthFactor
object
3 properties 2 required
api_session_v1_SnapchatOAuthFactor
object
3 properties 2 required
api_session_v1_SlackOAuthExchangeFactor
object
1 property 1 required
api_magic_v1_Options
object
2 properties 2 required
api_session_v1_SlackOAuthFactor
object
3 properties 2 required
api_user_v1_Password
object
2 properties 2 required
api_session_v1_CoinbaseOAuthFactor
object
3 properties 2 required
api_session_v1_RecoveryCodeFactor
object
1 property 1 required
api_session_v1_YahooOAuthFactor
object
3 properties 2 required
api_session_v1_TrustedAuthTokenFactor
object
1 property 1 required
api_session_v1_SalesforceOAuthFactor
object
3 properties 2 required
api_session_v1_AuthenticationFactorType
string
api_session_v1_OIDCSSOFactor
object
3 properties 3 required
api_password_v1_ResetStartRequestLocale
string
api_password_v1_passwords_email_ResetRequest
object
Request type
10 properties 2 required
api_password_v1_passwords_session_ResetResponse
object
8 properties 6 required
api_session_v1_WebAuthnFactor
object
3 properties 2 required
api_session_v1_HubspotOAuthExchangeFactor
object
1 property 1 required
api_session_v1_AuthenticatorAppFactor
object
1 property 1 required
api_session_v1_GithubOAuthFactor
object
3 properties 2 required
api_session_v1_SpotifyOAuthFactor
object
3 properties 2 required
api_session_v1_EmailFactor
object
2 properties 2 required
api_password_v1_passwords_session_ResetRequest
object
Request type
6 properties 1 required
api_device_history_v1_DeviceInfo
object
8 properties 1 required
api_session_v1_DiscordOAuthFactor
object
3 properties 2 required
api_user_v1_CryptoWallet
object
4 properties 4 required
api_user_v1_WebAuthnRegistration
object
6 properties 6 required
api_session_v1_GoogleOAuthFactor
object
3 properties 2 required
api_session_v1_AmazonOAuthFactor
object
3 properties 2 required
api_attribute_v1_Attributes
object
2 properties
api_session_v1_CryptoWalletFactor
object
3 properties 3 required
api_session_v1_PhoneNumberFactor
object
2 properties 2 required
api_password_v1_passwords_email_ResetStartResponse
object
4 properties 4 required
api_user_v1_Email
object
3 properties 3 required
api_session_v1_AuthenticationFactor
object
46 properties 2 required
api_session_v1_GithubOAuthExchangeFactor
object
1 property 1 required
api_device_history_v1_DeviceAttributeDetails
object
3 properties 1 required
api_session_v1_TikTokOAuthFactor
object
3 properties 2 required
api_user_v1_Name
object
3 properties
api_password_v1_passwords_existing_password_ResetRequest
object
Request type
8 properties 3 required
api_session_v1_EmbeddableMagicLinkFactor
object
1 property 1 required
api_user_v1_PhoneNumber
object
3 properties 3 required
api_session_v1_BiometricFactor
object
1 property 1 required
api_session_v1_FacebookOAuthFactor
object
3 properties 2 required
api_password_v1_passwords_email_ResetStartRequest
object
Request type
8 properties 1 required
api_user_v1_TOTP
object
2 properties 2 required
api_password_v1_passwords_email_ResetResponse
object
8 properties 6 required
api_session_v1_TwitterOAuthFactor
object
3 properties 2 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

stytch-passwords-api-openapi.yml Raw ↑

Other APIs Stytch publishes across the network.

Stytch Application API
Stytch B2B IDP API
Stytch B2B Impersonation API
Stytch B2B Magic Links API
Stytch B2B OAuth API
Stytch B2B OTP API
Stytch B2B Passwords API
Stytch B2B RBAC API
Stytch B2B Recovery Codes API
Stytch B2B SCIM API
Stytch B2B TOTP API
Stytch Clients API
Where this information came from

This is an independent, third-party profile of Stytch Passwords API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.