Changes the caller's password.
Every other session is ended, and a fresh one issued so the caller stays signed in where they are. Changing a password is how a person says that whoever knew the old one should stop being signed in.
Errors
401 when the current password is wrong, 403 when authenticated with an
API token, 400 when the new password fails the policy.
sessiontessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
application/json- body
Body of PATCH /auth/password.
current_password?|The current password. Required even though the caller is signed in: it stops a borrowed, unlocked browser from taking over the account.
Omitted by an account without one (has_password: false), which is
setting its first and confirms by a recent sign-in instead.
8 <= length <= 1024new_password*stringThe replacement.
8 <= length <= 1024Changed; other sessions ended
application/json- response
An account, as the API describes it. Never carries a hash.
email*stringNormalised address.
email_verified_at?|When the address was last proven to reach this user, or null if never.
Set by confirming a registration, by a provider vouching for the
address, or by following the link from
POST /account/email/verification. Cleared when the address changes.
date-timehas_password*booleanWhether the account has a password.
An account created through GitHub, Discord or OIDC has none. It confirms
changes by having signed in within the last few minutes instead of by
typing one, so a client shows a password field only when this is
true; see reauthentication_required.
id*stringStable identifier.
is_admin*booleanWhether the account holds the seeded administrator role.
Kept because clients read it, but derived and not stored, and narrower
than permissions. An account in a role granting users:read
and nothing else is not an administrator, yet reaches one administrative
endpoint. New clients should read permissions.
must_change_password*booleanWhether the account must set a new password before doing anything else.
Set on the administrator generated at first run. A client seeing this should send the user to a change-password screen and nowhere else.
permissions*array<string>Everything this account is allowed to do.
resource:verb strings, and what a client should decide from. A screen
guessing from is_admin is wrong for every role between "member" and
"everything".
quota_bytes?|A storage quota set on this one account, overriding its role's.
null means the role's applies; 0 means this account has no ceiling
of its own. What is actually left is storage_remaining_bytes on
/capabilities, which accounts for what has been used.
int640 <= valueroles*array<string>The roles it is in, by name.
username*stringNormalised account name.
curl -X PATCH 'https://example.com/api/v1/auth/password' \ -H 'Content-Type: application/json' \ -d '{ "new_password": "stringst"}'{ "email": "string", "email_verified_at": "2019-08-24T14:15:22Z", "has_password": true, "id": "string", "is_admin": true, "must_change_password": true, "permissions": [ "string" ], "quota_bytes": 0, "roles": [ "string" ], "username": "string"}