Change password

OpenAPI contract

Method

PUT

Path

/api/v1/user/password

Security

jwtBearer (bearer)

Response status

200 400 401 403 429 500

Request and response schemas

JSON

{
  "requestBody": {
    "application/json": {
      "$ref": "#/components/schemas/ChangePasswordRequest"
    }
  },
  "responses": {
    "200": {
      "description": "Password changed",
      "content": {
        "application/json": {}
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

PUT /api/v1/user/password is JWT-only. Send nonblank currentPassword and newPassword; the new password must be 6–100 characters. The service confirms the password change.

A successful change invalidates all existing access and refresh tokens, including those in the requesting browser. Clear the local session and sign in again with the new password.

An nfy_ automation key cannot change a password. Do not log, store, or send either password outside the HTTPS request. A wrong current password is rejected with the current-password error, and validation failures are rejected.

http

PUT /api/v1/user/password
Authorization: Bearer <access token>
Content-Type: application/json