@Operation(summary = "Initiate a password reset operation and notify the user",
        parameters = {
            @Parameter(name = "username", description = "The username to reset the password for"),
            @Parameter(name = "service", description = "The service requesting the password reset")
        })
    @PostMapping(path = "/reset/{username}", produces = MediaType.APPLICATION_JSON_VALUE)
    public ResponseEntity passwordReset(@PathVariable("username") final String username,
                                        @RequestParam("service") final String service,
                                        final HttpServletRequest request) throws Throwable {
        val query = PasswordManagementQuery.builder().username(username).build();

        val email = passwordManagementService.getObject().findEmail(query);
        val phone = passwordManagementService.getObject().findPhone(query);
        if (StringUtils.isBlank(email) && StringUtils.isBlank(phone)) {
            val message = "No recipient is provided with a valid email/phone for %s".formatted(username);
            LOGGER.warn(message);
            return ResponseEntity.unprocessableEntity().body(message);
        }

        val webApplicationService = serviceFactory.getObject().createService(service);
        val registeredService = servicesManager.getObject().findServiceBy(webApplicationService);
        val principal = resolvedPrincipal(username);

        val audit = AuditableContext.builder()
            .registeredService(registeredService)
            .service(webApplicationService)
            .principal(principal)
            .httpRequest(request)
            .build();
        val accessResult = registeredServiceAccessStrategyEnforcer.getObject().execute(audit);
        accessResult.throwExceptionIfNeeded();

        val url = passwordResetUrlBuilder.getObject().build(username, webApplicationService);
        val pm = casProperties.getAuthn().getPm();
        val duration = Beans.newDuration(pm.getReset().getExpiration());
        LOGGER.debug("Generated password reset URL [{}]; Link is only active for the next [{}] minute(s)", url, duration);
        val sendEmail = sendPasswordResetEmailToAccount(principal, email, url, request);
        val sendSms = sendPasswordResetSmsToAccount(phone, url);
        return sendEmail.isSuccess() || sendSms
            ? ResponseEntity.ok().build()
            : ResponseEntity.unprocessableEntity().body("Failed to send password reset instructions to %s".formatted(username));
    }
Password reset ops.

@return the response entity
support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/PasswordManagementEndpoint.java