Change or set the account password

Accounts that already have a usable password must supply the correct currentPassword; OAuth-only accounts (sentinel password) may set one without it. Bumps session_epoch (invalidates other sessions) and re-signs the caller’s cookie. Rate limited per-user (429).

Authorizations

• SessionCookie

Request Body^required

Media typeapplication/json

object

currentPassword

Required when the account already has a usable password

string

newPassword

required

string

>= 8 characters

Example^generated

json

{
  "currentPassword": "example",
  "newPassword": "example"
}

Responses

200

Changed; Set-Cookie re-signed session

Media typeapplication/json

object

ok

boolean

400

New password too short

Media typeapplication/json

object

error

required

Human-readable error message.

string

message

string

Example^generated

json

{
  "error": "example",
  "message": "example"
}

401

Not logged in / session invalid

Media typeapplication/json

object

error

required

Human-readable error message.

string

message

string

Example^generated

json

{
  "error": "example",
  "message": "example"
}

403

Current password incorrect/missing

Media typeapplication/json

object

error

required

Human-readable error message.

string

message

string

Example^generated

json

{
  "error": "example",
  "message": "example"
}

429

Rate limited

Media typeapplication/json

object

error

required

string

retryAfterSeconds

integer

Example^generated

json

{
  "error": "example",
  "retryAfterSeconds": 1
}

500

Session secret missing / account deactivated mid-write

Media typeapplication/json

object

error

required

Human-readable error message.

string

message

string

Example^generated

json

{
  "error": "example",
  "message": "example"
}