Skip to navigation
REST API EndpointsUsers

Modify Credentials

View as Markdown

Change the authenticated user’s username and password together.

Available to: All authenticated users

Environments: Live

Rate Limit: 5 requests per hour, 15-second back-off, counts all requests

Changes the username (name) and password for the calling user in a single request. The request must include the user’s currentPassword for re-authentication, the new name (3–64 characters), and the new password (8–64 characters).

Omit userId to change your own credentials. Organization administrators can change a member’s credentials by setting userId to the target user; the request is rejected for non-administrators who attempt to target a different user.

The username must be unique and is rejected if it is already registered to another user. Some organizations disable username changes for their members; in that case a non-administrator member cannot change the username. The new password is validated against the password policy and is also checked against known data breaches — if the password (or password and email together) appears in a breach, the request is rejected and hibpHint indicates which check failed (PasswordCompromised or EmailAndPasswordCompromised).

On success the response returns a fresh accessToken and expirationTime; the change rotates the access token, so update the token your client uses for subsequent requests. To change only the password, use modifyPassword.

Common Failure Scenarios

  • currentPassword does not match the user’s current password.
  • The requested name is already registered to another user.
  • The organization does not allow members to change their username.
  • The new password fails the password-policy check or appears in a known data breach.
  • A non-administrator sets userId to a user other than themselves.

Error Messages

errorTextTrigger
Incorrect current passwordcurrentPassword does not match the user’s current password.
Username is already registered. Please select a new username.The requested name is taken by another user.
Username change is not allowed for this organizationThe organization disables username changes for members.
Password has been compromised in a data breach. Please choose different passwordThe new password appears in a known data breach.
Your password and email has been compromised in a data breach. Please choose different passwordThe new password and email appear together in a known data breach.
Password should not include usernameThe new password contains the username.
Password should not include emailThe new password contains the email address.
Password should not include 1234, tradovate, ninjatrader, qwerty or abcdThe new password contains a common sequence.
Non-empty errorTextThe request failed; the field describes the reason.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Request

This endpoint expects an object.
namestringRequired3-64 characters
passwordstringRequired8-64 characters
currentPasswordstringRequired<=64 characters
userIdlongOptional

Response

AccessTokenResponse
errorTextstringOptional<=8192 characters

Non-empty if the request failed

hibpHintenumOptional
EmailAndPasswordCompromised, PasswordCompromised
Allowed values:
accessTokenstringOptional<=8192 characters
expirationTimedatetimeOptional
passwordExpirationTimedatetimeOptional
userStatusenumOptional
Active, Closed, Initiated, TemporaryLocked, UnconfirmedEmail
Allowed values:
userIdlongOptional
namestringOptional<=64 characters
hasLivebooleanOptional
ownsUnarchivedLivebooleanOptional
hasApprovedTradingPermissionbooleanOptional
hasSimPlusbooleanOptional
showKIDsbooleanOptional