Change password
POST
/v1/me/change-password
Change the signed-in user's password. Re-enter the current password to confirm, then supply a new one that meets the minimum-strength rule and differs from the current password. A wrong current password is rejected (403), as is a too-weak or unchanged new password (400). An account that only signs in with Google or Apple has no password to change (409). On success a "password changed" alert is emailed to the account address. Requires an interactive login: this security action can't be performed with an API key (403 interactive_auth_required).
Authorizations
Bearer
JWT bearer token from POST /v1/auth/login.
Type
HTTP (bearer)
or
ApiKey
Scoped API key for non-interactive clients (issued by PBI #1426).
Type
API Key (header: X-Api-Key)
Request Body
application/json
Password-change payload (POST /me/change-password, #2124) — the current password + the new one.
The account's current password, re-entered to authorize the change.
The new password to set (must meet the strength rule and differ from the current).
Responses
OK
application/json
Password-change result (POST /me/change-password, #2124).
true when the password was changed.
A fresh JWT for the acting session (#2126): changing the password invalidates every
other session, so the caller swaps its token for this one to stay signed in. null only in
the unexpected case that the just-changed account could not be reloaded.