There are several discussions on this forum about creating user accounts by other users, through management api and then sending them customized 'Change Password’ email templates that look like invitation emails: link1, link2. I want to implement a similar solution and I am wondering if this is legal?
I would say whether it’s legal depends on the business relationship that you have with these users or not, and also of course the country’s law where your business is located in in regards to data privacy and spam. Hard to give a general answer here that applies world-wide.