Authentication API
3 PracBill API endpoints for authentication. Base URL https://billing.pracbill.com.au/api.
Authenticate user and retrieve API key
GET /get-key/{user}/{pass}
Responses
200— Authentication result
Complete a password reset
POST /password-reset/confirm
Completes the internal-user password reset flow using a token issued by /password-reset/request. Unauthenticated (no API key). Validates that the token is a 64-character lowercase hex string, that the password is at least 8 characters, and that password and password_confirm match, before resetting the password and consuming the token. Used, expired, malformed or unknown tokens return a generic invalid/expired response. Tokens and passwords are never written to API request logs.
Request body
| Field | Type | Description |
|---|---|---|
token required | string | The 64-character lowercase hex reset token from the emailed reset link. |
password required | string | The new password (minimum 8 characters). |
password_confirm required | string | Must match password. |
Responses
200— Reset result. success is true when the password was reset; otherwise false with a validation or generic invalid/expired error.
Request a password reset
POST /password-reset/request
Initiates the internal-user password reset flow. Unauthenticated (no API key). Accepts a username or email address and always returns a generic success response so account existence is never revealed. When the account exists and is active, a reset token is created and emailed. Tokens and passwords are never written to API request logs.
Request body
| Field | Type | Description |
|---|---|---|
username required | string | The username or email address of the account to reset. |
Responses
200— Generic success response (returned for valid, invalid, unknown and malformed usernames).