question: @ RequestMapping ( value = ApiUrl . CITIZEN_PASSWORD_RECOVER , method = RequestMethod . POST ) public ResponseEntity < String > passwordRecover ( HttpServletRequest request ) { ApiResponse res = ApiResponse . newInstance ( ) ; try { String identity = request . getParameter ( "identity" ) ; String redirectURL = request . getParameter ( "redirectURL" ) ; String token = request . getParameter ( "token" ) ; String newPassword , confirmPassword ; if ( StringUtils . isEmpty ( identity ) ) { return res . error ( getMessage ( "msg.invalid.request" ) ) ; } if ( ! StringUtils . isEmpty ( token ) ) { newPassword = request . getParameter ( "newPassword" ) ; confirmPassword = request . getParameter ( "confirmPassword" ) ; if ( StringUtils . isEmpty ( newPassword ) ) { return res . error ( getMessage ( "msg.invalid.request" ) ) ; } else if ( ! newPassword . equals ( confirmPassword ) ) { return res . error ( getMessage ( "msg.pwd.not.match" ) ) ; } else if ( identityRecoveryService . validateAndResetPassword ( token , newPassword ) ) { return res . success ( "" , getMessage ( "msg.pwd.reset.success" ) ) ; } else { return res . error ( getMessage ( "msg.pwd.otp.invalid" ) ) ; } } if ( identity . matches ( "\\d+" ) ) { if ( ! identity . matches ( "\\d{10}" ) ) { return res . error ( getMessage ( "msg.invalid.mobileno" ) ) ; } } else if ( ! identity . matches ( "^[A-Za-z0-9+_.-]+@(.+)$" ) ) { return res . error ( getMessage ( "msg.invalid.mail" ) ) ; } Citizen citizen = citizenService . getCitizenByUserName ( identity ) ; if ( citizen == null ) { return res . error ( getMessage ( "user.not.found" ) ) ; } if ( identityRecoveryService . generateAndSendUserPasswordRecovery ( identity , redirectURL + "/egi/login/password/reset?token=" , true ) ) { return res . success ( "" , "OTP for recovering password has been sent to your mobile" + ( StringUtils . isEmpty ( citizen . getEmailId ( ) ) ? "" : " and mail" ) ) ; } return res . error ( "Password send failed" ) ; } catch ( Exception e ) { LOGGER . error ( "EGOV-API ERROR " , e ) ; return res . error ( getMessage ( "server.error" ) ) ; } }
target:  This will send an email/sms to citizen with link. User can use that link and reset their password.