There's no REST endpoint that returns the link directly — the reset-password email is assembled inside the LoginActionsService with a fresh action token per send. Workaround: use the admin REST PUT /users/{id}/execute-actions-email?redirect_uri=...&client_id=... which triggers the email and accepts a redirect_uri you control. For your "invite user" flow, overriding the email-verification.ftl template to include your branding is usually cleaner than recreating the link yourself.