{"record":{"id":"28387cddfc34e9c4","repo":"payloadcms/payload","slug":"missing-required-data","errorCode":null,"errorMessage":"Missing required data.","messagePattern":"Missing required data\\.","errorType":"exception","errorClass":"APIError","httpStatus":400,"severity":"error","filePath":"packages/payload/src/auth/operations/resetPassword.ts","lineNumber":55,"sourceCode":"  args: Arguments,\n): Promise<Result> => {\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess,\n    req: {\n      payload: { secret },\n      payload,\n    },\n    req,\n  } = args\n\n  if (\n    !Object.prototype.hasOwnProperty.call(data, 'token') ||\n    !Object.prototype.hasOwnProperty.call(data, 'password')\n  ) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  let sid: string | undefined\n  let user: null | User = null\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'resetPassword',\n      overrideAccess,\n    })","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/auth/operations/resetPassword.ts#L37-L73","documentation":"Thrown in `resetPassword` when `data` lacks either `token` or `password` (checked via `Object.prototype.hasOwnProperty.call`). Both are required to look up the reset request and set the new credential. `APIError` with HTTP 400 (BAD_REQUEST).","triggerScenarios":"A `POST /api/<collection>/reset-password` request body omits `token` or `password`; a form submits an empty password field; the reset link's token query param was never transferred into the POST body. Also via Local API with `data: { password }` missing `token`.","commonSituations":"Frontend posts only the new password, forgetting the token extracted from the email link; a typo/destructure mistake (`data: { token }` instead of `data: { token, password }`); an empty-string password that some clients strip before sending.","solutions":["Send both fields: `data: { token, password }` where `token` is the value from the reset email URL.","Validate client-side that both are non-empty before posting.","If using the Local API, build the full `data` object including the token from the email link.","Ensure form serialization includes the hidden token input."],"exampleFix":"// before\nawait payload.resetPassword({ collection: 'users', data: { password }, req })\n// after\nawait payload.resetPassword({ collection: 'users', data: { token, password }, req })","handlingStrategy":"validation","validationCode":"// Validate both fields are present before resetting\nif (!data.token || !data.password) {\n  throw new Error('Both token and password are required')\n}\nawait payload.resetPassword({ collection, data: { token, password }, req })","typeGuard":"function hasResetFields(data: unknown): data is { token: string; password: string } {\n  return typeof data === 'object' && !!data\n    && Object.prototype.hasOwnProperty.call(data, 'token')\n    && Object.prototype.hasOwnProperty.call(data, 'password')\n}","tryCatchPattern":"try {\n  await payload.resetPassword({ collection, data, req })\n} catch (e) {\n  if (e instanceof APIError && e.status === 400) {\n    // show 'token and password required' to the user\n  } else throw e\n}","preventionTips":["Validate `token` and `password` are non-empty on the client.","Pass the token from the email link straight into the POST body.","Include the token as a hidden form field so it is never omitted."],"tags":["auth","reset-password","validation","bad-request"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}