Issue with Programmatically Sending Password Reset Emails in Bulk via /u/{username}/password-reset.json

Hello Discourse Community,

I’m trying to automate sending password reset emails in bulk for users on our self-hosted Discourse instance (version 3.5.0.beta7-dev). The users are listed in a CSV file containing only custom_username, and their email addresses are stored in their Discourse profiles. While the manual password reset from the admin panel (/u//preferences/security) works perfectly, my Python script using the /u/{username}/password-reset.json endpoint fails to send emails. I’d appreciate any guidance on troubleshooting this issue.

What I’ve Done

  1. User Creation:
  • I’ve successfully created users via the POST /users.json endpoint using a Python script. The payload is:

json

DaraltMetni gizle

Kopyala

{ "email": "<email>", "username": "<custom_username>", "password": "", "active": true, "approved": true, "send_welcome_message": false }

  • Users appear in the admin panel (/admin/users), and their email addresses are correctly stored in their profiles.
  1. Manual Password Reset:
  • From the admin panel (/u//preferences/security), clicking the “Reset Password” button sends a password reset email to the user’s registered email address, confirming that SMTP and Sidekiq are configured correctly.
  1. Programmatic Password Reset:
  • I’m using a Python script to send password reset emails via POST /u/{username}/password-reset.json. The script:
    • Reads custom_username from approved_users.csv (e.g., kebirx-ustat45947).
    • Verifies the user exists via GET /u/{username}.json.
    • Sends a POST request to /u/{username}/password-reset.json.
  • Simplified code:

python

DaraltMetni gizleÇalıştır

Kopyala

response = requests.post( f"{FORUM_URL}/u/{username}/password-reset.json", headers={"Api-Key": API_KEY, "Api-Username": API_USERNAME}, timeout=10 )

  • The response is 200 OK, but no emails are sent. No errors appear in the script logs (discourse_send_welcome_emails.log) or Sidekiq logs.
  1. Previous Attempt:
  • I tried using POST /admin/users/{user_id}/send_welcome-email.json, but it returned a 404 error. I couldn’t find this endpoint in the API documentation, so I switched to /u/{username}/password-reset.json.

Environment

  • Discourse Version: 3.5.0.beta7-dev
  • Setup: Self-hosted, accessible at https://forum.kebirxai.tr
  • API Key: Admin-scoped with full permissions
  • CSV Format:

csv

DaraltMetni gizle

Kopyala

custom_username kebirx-ustat45947 keb21

  • Logs:
    • Script logs show 200 OK for each POST /u/{username}/password-reset.json call, but no emails are received.
    • Sidekiq logs (/var/www/discourse/log/sidekiq.log) and production logs (/var/www/discourse/log/production.log) show no email-related errors.
    • Manual test emails from /admin/email work fine.

Questions

  1. Is /u/{username}/password-reset.json the correct endpoint for programmatically triggering password reset emails? If not, what’s the recommended endpoint for bulk password reset emails?
  2. Why might the endpoint return 200 OK but not send emails? Could this be related to API permissions, Sidekiq queue issues, or SMTP configuration specific to API-triggered emails?
  3. Rate Limiting: I’m processing users in batches of 25 to avoid rate limits. Are there specific rate limits for /u/{username}/password-reset.json?
  4. Alternative Approaches: Is there a more efficient way to trigger password reset emails for multiple users without individual API calls? For example, a bulk endpoint or a Sidekiq job?
  5. Debugging: What logs or settings should I check to identify why API-triggered emails aren’t being sent, despite manual resets working?

Additional Notes

  • The manual reset from the admin panel works, so SMTP (configured in app.yml) and Sidekiq appear functional.
  • I’ve verified that users exist and their email addresses are correct in the admin panel.
  • No errors appear in the script or server logs, which makes debugging challenging.

Any suggestions on troubleshooting, alternative endpoints, or best practices for bulk password reset emails would be greatly appreciated. If there are undocumented APIs, plugins, or configuration tweaks, please let me know. Thank you!

1 Like

I think you don’t need an api key? I’m not sure you can request a password if you’re logged in.