> ## Documentation Index > Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt > Use this file to discover all available pages before exploring further. # Recover ID & Reset Password Processes These Processes enable an anonymous user to recover their User ID and reset a forgotten password. Together, they provide the "forgot password?" user journey. If the user misplaces and forgets their password, they can use their registered email address or mobile number to recover their User ID, and then set a new password to replace lost one. This complete operation is orchestrated by two distinct but related Processes, because the user will need to navigate from the client UI to complete their journey. This second Process ends by signing the user **out** of all their current open sessions, except for the current one. ## Multiple Process Orchestration Most user journeys are facilitated by a single Process. However, there are some cases where Digital Identity Management orchestrates and links two or more Processes together to complete a given journey. The **Recover ID** Process starts the user journey and sends a verification [action token](c_actionTokens) to the user's verified email address or mobile number. Once the user redeems that token with the [Session Token](c_sessionToken#) API, that API invokes the **Reset Password Process** that allows the user set a new password. ## Process Flow This table describes the Processes at a high level. **Preconditions** * The user has a fully activated User entity with a verified authN ID * The user is currently anonymous to Digital Identity Management (i.e., they are not signed in). **Basic Flow** 1. From the sign-in page, the user clicks a **Forgot Password?** The **Recover ID** Process starts here. 2. The user submits an email or mobile registered as their registered authentication identifier (authN ID). 3. Digital Identity Management quickly looks up the User entity with the authN ID. The following condition apply: * If the User entity has more than one registered, verified authN ID, then the Process returns a list of obfuscated authN IDs to select one. The user must select one before the Process proceeds. * All emails and mobile numbers returned by the Process are obfuscated according to Obfuscation settings. Thee settings are configured in the MarketONE Admin console. * If the User entity only has one authN ID, then the Process simply proceeds. 4. Digital Identity Management sends a verification [action token](c_actionTokens) to the user's selected email/mobile. The **Recover ID** Process ends here. The Process return a PKAT to the client. * Digital Identity Management sends the user either a long-form, clickable link (with a the token appended to the URL), a short-form One-Time Passcode (OTP), or both. 5. The user retrieve and redeems the action token. The **Reset Password** Process starts here. 6. Digital Identity Management prompts the user to set a new password. 7. The user submits their new password. * Password complexity rules are set in the Admin web application. **Postconditions** * The user's password has been reset. * If the user had any other open sessions, then they are closed. The end user would then need to re-authenticate. **Possible or Common Errors** * User not found * **Note:** If the user supplies an invalid authN ID, the Process returns a generic message to the client application, which then shows the user **Recovery link has been sent to the provided \{email address or mobile number}.** This is a security measure to previous malicious actors from determining authN IDs by trial and error., * The provided password does not match password complexity rules. * The user has reached the maximum number of failed input attempts. * Exceeded the limit OTP entry attempts. ## App Settings Certain aspects of the Process' behavior are controlled by configurable [system settings](https://docs.vindicia.com/bundle/b_connectAdminGuide/page/topics/appSettings_c.html). Your organization can manage these and other settings in the [Digital Identity Management Admin](https://docs.vindicia.com/bundle/b_ConnectProductDescription/page/topics/adminPortal_c.html) console. | Application Settings | Default Setting | | | | - | - | - | - | | **Password Complexity Rules** | Defines the criteria for a valid password when the user is onboarding, or resetting/updating their password. Configuration points include:- **Upper case characters** - The password requires at least one uppercase (A-Z) character. - **Lower case characters** - The password requires at least one lowercase (a-z) character. - **Special characters** - The password requires at least one [special character](reusePasswordSettingSpecialCharsList). - The password requires at least one numeric (0-9) character. - The minimum password length. | - A-Z: Enabled - a-z: Enabled - (!"#\$%&'()\*+,-./:;=>?@\[\\]^\_\`\{\\ | \}\~): Enabled - 0-9: Enabled - Minimum length: 8 | | **Email Obfuscation Grouping Pattern** | JavaScript Object Notation (JSON) that defines how displayed user emails are grouped together. | `(\w{1})(\w+)?(@.*)` | | | **Email Obfuscation Rule** | JSON that defines the masking pattern that obfuscates displayed emails. | `$1****$3` | | | **Valid Email Pattern** | Defines the logic for an acceptable email format. JSON format. | `^[\w.-]+@[\w.-]+\.[a-zA-Z]{2,4}$` | | | **Mobile Number Obfuscation Grouping Pattern** | JSON that defines how displayed user mobile numbers are grouped together. | `^\(?([0-9]{1})([0-9]{2})\)?[-.\s]?([0-9]{3})[-.\s]?([0-9]{3})([0-9]{1})$` | | | **Mobile Number Obfuscation Rule** | JSON that defines how the masking pattern that obfuscates displayed mobile numbers. | `($1**)***-***$5` | | | **Valid Mobile Number Pattern** | Defines the logic for an acceptable mobile number format. JSON format. | (!"#\$%&'()\*+,-./:;=>?@\[\\]^\_\`\{\\ | \}\~) | | **Token URL** | Base for the action token URL to include in the notification message sent to the user's external channel (email). The actual token value will be appended to this String to form the complete URL.This app setting is applicable for when a user onboards with their email address. The Process sends the token out to that email for verification and user activation. | [https://idp/user\\\_confirm?token\\\_value=](https://idp/user\\_confirm?token\\_value=) | | | **Long Token Expiration Period** | Determines the number of minutes before the invitation link expires. | 28800 (20 days) | | | **Short Token Expiration Period** | Determines the number of minutes before an OTP expires. | The expiration period ranges from 0-5 minutes | | | **Note:** The obfuscation rule default values are a little large to display here. You can sign into the MarketONE Admin console and view the default settings there. | | | | ## User Journey Diagram This diagram illustrates the standard "Forgot Password?" user journey using the **Recover ID** and **Reset Password** Processes. \[product: dim]\[/product: dim] This diagram also incorporates: * A quick resend verification message option ([PUT session/token](c_putSessionToken)) * Long-form redirect URL and short-form OTP verification options ([GET session/token](c_sessionToken#)) ## Use Cases The following use cases provide guided API walkthoughs of these Processes for client developers: * [Recover user identity](c_useCaseRecoverID) (user has one authN ID) * [Recover multiple user identities](c_useCaseRecoverIDMultiple) (user has multiple authN IDs) * [Reset password with clickable reset link](c_useCaseResetLink) * [Reset password with OTP](c_useCaseResetOTP) * [Forgot password errors](c_forgotPasswordErrors) ## See also * These Processes are distinct from the [Update Password](c_updatePassword) Process that is invoked from an authenticated state, and requires the user to know and supply their current password. However, that Process does not require the user to navigate away to retrieve an action token. * **[Recover user identity (single authN ID)](../topics/c_useCaseRecoverID)** * **[Recover user identity (multiple authN IDs)](../topics/c_useCaseRecoverIDMultiple)** * **[Reset password with verification link](../topics/c_useCaseResetLink)** * **[Reset password with OTP](../topics/c_useCaseResetOTP)** * **[Forgot Password Errors](../topics/c_forgotPasswordErrors)** **Parent topic:**[Identity Management Processes](../images/c_identityProcesses) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.