Change (or set) the authenticated user's password

POST 
/api/v1/auth/change-password

Rotates the caller's password without an emailed reset token. currentPassword is required when the account already has a password; for an SSO-only account (hasPassword: false on /api/v1/auth/me) it is ignored and this call sets the initial password, provided the session comes from a sign-in within the last 10 minutes (otherwise 403 REAUTHENTICATION_REQUIRED: sign in again first). All of the caller's other sessions are revoked; the calling session and any personal access tokens keep working. A confirmation email is sent. While mustChangeEmail is true on /api/v1/auth/me, the optional email is written in the same update as the new password (the confirmation email then goes to the new address); any other caller sending email gets 400.

Request

Responses

200

Password changed

400

Validation error

401

Not authenticated, or the supplied currentPassword is wrong (error code INVALID_CURRENT_PASSWORD).

403

The account has no password and the session's sign-in is more than 10 minutes old (error code REAUTHENTICATION_REQUIRED).

404

Resource not found

409

Resource conflict

429

Too many requests