AnkraDocs
Console

API reference · Access and identity

Password change

1 operation of the Ankra Cloud API: A signed-in user replacing their own password after proving the current one.

Change your password#

PUT/v1/account/password
Operation
change_account_password
Credentials
Portal session
Requires
Permission self

The signed-in user replaces their password after proving the current one. The new password meets the signup policy (12 to 1024 characters, not a known breached password, not the current one) and is stored as an argon2id hash. In one transaction the change ends every other session of the user (the one making the call stays), spends every open password reset link of the user and records user.password_changed in the user's account audit log. API tokens stay; revoke them on their own page if they may be compromised. A wrong current password is recorded as user.password_change_failed, and repeated ones lock the user out of this route for a while (429), like failed sign-ins. A refusal carries a stable reason: current_password_wrong (403), weak_password (400), no_password (409, the user signed up through an identity provider and sets a first password with a reset link) or changed_meanwhile (409). Session-only; refused to support sessions. Rate limited per client network (10 a minute).

Request bodyapplication/json · PasswordChange

Request body fields
FieldTypeDescription
current_passwordrequiredstring
new_passwordrequiredstring

Responses

200The password is replaced and every other session of the user has ended.application/json · PasswordChanged

200 response fields
FieldTypeDescription
ended_sessionsrequiredintegerHow many other sessions of the user the change ended.
  • 400The body or the new password was refused.
  • 401Not signed in, or the credential is invalid or expired.
  • 403The current password is wrong (reason is current_password_wrong), or the caller is a support session or an API token.
  • 409The user has no password to change, or it changed while the request ran; reason says which.
  • 429Rate limited. On a customer operation the credential (the API token, or the signed-in user for a session) is over its requests per minute and the X-RateLimit-* headers say when the window ends; on a sign-in route the client network is over its attempts or the email is locked out.
  • defaultAny other error, usually 500.

Example

bash
curl -X PUT 'https://cloud.ankra.app/v1/account/password' \
  -b "ankracloud_session=$SESSION" \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
  "current_password": "string",
  "new_password": "string"
}'