Change a user's password

POST 
/users/:username/change-password

Sets a new password for a user. This is an administrative reset: the user's current password is not required and is not checked.

What temporary does. Sending "temporary": true marks the new password as one-time, and the directory then requires the user to choose their own password at their next login before they can go anywhere. Sending false, or omitting the field, stores the password permanently and forces nothing; the user can keep using the password you set indefinitely. There is no middle setting, and no way to expire it later through this API.

Existing sessions are not ended. Prism sets the credential and nothing else: it sends no logout, revokes no refresh token and clears no session. Anyone already signed in as this user, including whoever the password change was meant to lock out, stays signed in until their session expires on its own. A password change is not a way to eject someone; end their sessions separately.

Prism may email the new password to the user in plain text. Where the deployment has notification email configured, a message containing the password you sent is dispatched to the address on the user's record, asynchronously and after the change has already been applied. A user with no email address on file gets no notification, and the call still returns 200, and you cannot tell from the response whether a mail went out. Prism's own audit trail stores the request body with the password redacted.

The only rule Prism enforces on the password is a minimum length of 8 bytes: bytes, not characters, so seven multi-byte characters slip through. There is no maximum and no complexity requirement here. Your realm's own password policy still applies on top, and a password it rejects surfaces as a 500, not a 400.

Request

Responses

200

The password was changed. Any notification email is dispatched in the background, so whether one was sent, and whether it arrived, is not reflected here.

400

The request was rejected before the password was changed: the body was not valid JSON, newPassword was missing or empty, or it was shorter than 8 bytes.

401

Authentication failed: the X-API-Token header was missing, malformed, expired or not recognised.

This response is text/plain, not JSON. It is written by http.Error in the authentication middleware, which runs before any handler and therefore before anything that would build a JSON envelope. A client that unconditionally JSON-parses response bodies will fail on this one, so check the status code first.

403

The token is valid, but it is not allowed to act on this tenant.

An API token is minted inside one tenant and stays bound to it for life. Sending it to a path whose tenant segment names a different tenant is refused here, in middleware, before the operation runs, so this says nothing about the resource you asked for, only about which tenant the path named. Check the tenant server variable against the console the token was created in.

404

No tenant matches the tenant segment of the request path.

A user who does not exist is not reported here. This operation has no not-found handling of its own: an unknown username, or an email address passed where a username was expected, is a 500.

500

The password was not changed. Everything that can go wrong past validation lands here with no further distinction: no user matched the username, the realm's password policy rejected the value, or the directory was unreachable. Read error to tell them apart.