When a user requests to reset their password via the /request-password-reset endpoint, an email is sent to the email address of the primary profile of the account. This email contains a link with a reset token as query parameter. The link should take the user to the "reset-password" page of the website.
From the reset-password page a user should enter the new password they wish to use. It should then be submitted to this endpoint, along with the reset token from the email link. The token should be provided in the body as resetToken property.