{
  "Protocol": "AIXE",
  "Version": "1.0",
  "Endpoint": "/aixe/account/forgot-password",
  "DiscoveryRequest": "GET /aixe/account/forgot-password/?",
  "CanonicalHelpTrigger": "GET /aixe/account/forgot-password/?",
  "ActionRequest": "POST /aixe/account/forgot-password",
  "Method": "POST",
  "ContentType": "application/json; charset=utf-8",
  "Title": "Request Password Reset",
  "AuthenticationRequired": false,
  "AccessType": "Public",
  "Purpose": "Accepts an email address and sends a time-limited password-reset link when it belongs to an active profile.",
  "DocumentationSource": "AIXEEndpointRegistry",
  "ProtocolReference": {
    "ProtocolHome": "http://aixeprotocol.com/",
    "CanonicalUsageContract": "http://aixeprotocol.com/usage/?",
    "Whitepaper": "http://aixeprotocol.com/whitepaper/full-spec.html",
    "Inventor": "Gregory Oglethorpe",
    "IncludeIn": [
      "/aixe.ai starter discovery documents",
      "Every endpoint self-description returned by GET /endpoint/?"
    ],
    "AIInstruction": "Read this live endpoint contract as operational guidance, not merely as a transport schema. Use its purpose, field meanings, business rules, outcomes, and recovery guidance to reason about whether and how to perform the capability."
  },
  "UsageGuidance": {
    "Role": "Use this when the human cannot log in because they do not know their password.",
    "CorrectWorkflow": [
      "Use this when the human cannot log in because they do not know their password.",
      "Report the same accepted result whether or not an account exists."
    ],
    "DoNotDo": [
      "Do not send business variables, keys, filters, or action inputs in the URL or query string.",
      "Do not infer success from HTTP status alone."
    ]
  },
  "AIUsageGuidance": {
    "ContractRole": "This live document teaches an AI what the capability means and how to use it; it is not merely a list of request fields.",
    "ReasoningInstruction": "Decide whether this capability serves the human\u0027s intent from Purpose and BusinessRules, gather values using each field\u0027s Description and constraints, then interpret the returned SuccessCode before reporting an outcome.",
    "FieldInstruction": "Field names are transport labels. Their Description, source, constraints, and business meaning explain what information the AI should obtain and why."
  },
  "RequiredFields": {
    "Email": {
      "Type": "string",
      "Description": "The email address that may belong to an active profile.",
      "Required": true,
      "SubmittedIn": "JSON body",
      "Format": "email address",
      "MaxLength": 254
    }
  },
  "OptionalFields": {},
  "BusinessRules": [
    "The response never reveals whether an email address is registered.",
    "A generated reset link expires after 30 minutes.",
    "This action does not change a password."
  ],
  "ResponseFields": {
    "SuccessCode": {
      "Type": "string",
      "Description": "The authoritative action outcome.",
      "Required": true,
      "SubmittedIn": "Response body"
    },
    "RequestAccepted": {
      "Type": "boolean",
      "Description": "True when the request was accepted without revealing whether the email exists.",
      "Required": true,
      "SubmittedIn": "Response body"
    },
    "Message": {
      "Type": "string",
      "Description": "Safe next-step guidance for the human.",
      "Required": true,
      "SubmittedIn": "Response body"
    }
  },
  "Errors": [
    {
      "SuccessCode": "VALIDATION_FAILED",
      "Meaning": "One or more required request values are missing or malformed.",
      "Recovery": "Use the field descriptions and constraints in this contract, correct the named fields, and retry the same capability.",
      "Recoverable": true
    },
    {
      "SuccessCode": "FAILED",
      "Meaning": "The capability could not complete for an execution failure.",
      "Recovery": "Read the returned message and error detail. Retry only when the response identifies a recoverable condition.",
      "Recoverable": false
    }
  ],
  "ActionResponse": {
    "RequiredResponseFields": [
      "SuccessCode"
    ],
    "SuccessCodes": [
      "SUCCESS"
    ],
    "FailureCodes": [
      "VALIDATION_FAILED",
      "FAILED"
    ],
    "NonFinalCodes": [],
    "MissingOrEmptyResponse": "Treat as FAILED.",
    "Rule": "The endpoint response is authoritative. Only an exact SuccessCode value listed in SuccessCodes means the business action succeeded; HTTP status alone does not declare the AIXE outcome."
  }
}