Reset User Password
const url = 'https://example.com/admin/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/reset-password/';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"password":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/admin/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/reset-password/ \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "password": "example" }'Set a user’s password (admin only).
The manage_users permission authorizes this recovery path, so no current
password is required. The submitted password is stored only as a hash and
is omitted from audit details, logs, and the response.
Returns 422 when the target signs in through an identity provider and has no local password, or 404 when the user does not exist.
Resetting your own password is permitted and ends every session the account holds, including the one making this request, because the reset revokes the account’s credentials.
Authorizations
Section titled “ Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “ Path Parameters ”Request Body required
Section titled “ Request Body required ”Request body for POST /admin/users/{user_id}/reset-password/.
Single-purpose for the same reason as SamlToLocalConversion above: the generic UserUpdate schema has no password field, so an admin-set password lands as its own audited action (‘user.password_reset’) rather than disappearing into ‘user.update’.
object
Replacement password for the account (policy: min 12 chars, 3+ character classes, at most 72 bytes UTF-8). The user can change this after their next login.
Example generated
{ "password": "example"}Responses
Section titled “ Responses ”Successful Response
object
Account status: active, pending, suspended, or deactivated.
Assigned role names, e.g. [‘admin’, ‘editor’]
Whether an administrator can set a local password for this account. True for local accounts even when an identity provider is also linked.
Per-user quota usage: current consumption vs configured caps.
object
Example
{ "status": "active"}Bad request — invalid query parameters or payload
Unauthorized — missing or invalid credentials
Forbidden — caller lacks access to this resource
Not found
Validation error
Too many requests — retry after the advertised interval
Headers
Section titled “ Headers ”Seconds until the request may be retried
Internal server error
Service unavailable — the database could not serve the request