Change my password

PUT

/account/password

• Local development behind nginx (port 8088 by default)

Self-service password change. Verifies the current password, applies the policy (min length / complexity from system_config.auth.password_policy), rejects reuse of the last 5 passwords, and (optionally) revokes every other session belonging to the caller as a defensive default.

Authorizations

• cookieAuth
• bearerAuth

Request Body ^required

object

current_password

required

The caller’s current password — verified before the change is accepted.

string

new_password

required

The new password. Must satisfy the system password policy.

string

revoke_other_sessions

When true, every session belonging to the caller EXCEPT the one authenticating this request is revoked. Defensive default for “I think someone got my password” recovery flows. Defaults to true client-side; the server doesn’t assume either way (omitting the field = false).

boolean

Responses

200

Password changed.

object

changed_at

required

string format: date-time

sessions_revoked

Count of other sessions ended as part of this change.

integer

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

500

Unexpected server error

object

error

required

Human-readable error summary

string

Example

the request could not be completed