Reset Current User Password
POST/api/v1/auth/accounts/reset-password
Change the authenticated user's own password, given the current one.
The username is taken from the session, not the request, so a caller cannot
reset another account through this route. current_password must be the
account's password, so a stolen session token cannot take the account over;
wrong guesses back off as sign-in failures do. An IdP-owned (external)
account is refused: it has no local password. The live store takes the new
password immediately and every session the account held ends, this one
included, so the owner signs in again. The git block reports whether the
durable mirror merged, is pending review, or is a no-op for a non-git-backed
account.
An account on an issued password may call this and nothing else that
changes state, and the reset clears password_change_required.
Request
Responses
- 200
- 401
- 403
- 422
- 429
- default
Successful Response
No valid session: the credentials are missing, invalid or expired, or the account behind them is disabled or blocked
current_password is not the account's password (invalid_current_password)
Validation Error
Too many wrong current passwords; Retry-After gives the seconds to wait
Problem details (RFC 9457)