Modify Credentials

POST

/user/modifycredentials

Change the authenticated user’s username and password together.

Available to: All authenticated users

Environments: Live

Rate Limit: 5 requests per hour, 15-second back-off, counts all requests

Changes the username (name) and password for the calling user in a single request. The request must include the user’s currentPassword for re-authentication, the new name (3–64 characters), and the new password (8–64 characters).

Omit userId to change your own credentials. Organization administrators can change a member’s credentials by setting userId to the target user; the request is rejected for non-administrators who attempt to target a different user.

The username must be unique and is rejected if it is already registered to another user. Some organizations disable username changes for their members; in that case a non-administrator member cannot change the username. The new password is validated against the password policy and is also checked against known data breaches — if the password (or password and email together) appears in a breach, the request is rejected and hibpHint indicates which check failed (PasswordCompromised or EmailAndPasswordCompromised).

On success the response returns a fresh accessToken and expirationTime; the change rotates the access token, so update the token your client uses for subsequent requests. To change only the password, use modifyPassword.

Common Failure Scenarios

currentPassword does not match the user’s current password.
The requested name is already registered to another user.
The organization does not allow members to change their username.
The new password fails the password-policy check or appears in a known data breach.
A non-administrator sets userId to a user other than themselves.

Error Messages

`errorText`	Trigger
`Incorrect current password`	`currentPassword` does not match the user’s current password.
`Username is already registered. Please select a new username.`	The requested `name` is taken by another user.
`Username change is not allowed for this organization`	The organization disables username changes for members.
`Password has been compromised in a data breach. Please choose different password`	The new password appears in a known data breach.
`Your password and email has been compromised in a data breach. Please choose different password`	The new password and email appear together in a known data breach.
`Password should not include username`	The new password contains the username.
`Password should not include email`	The new password contains the email address.
`Password should not include 1234, tradovate, ninjatrader, qwerty or abcd`	The new password contains a common sequence.
Non-empty `errorText`	The request failed; the field describes the reason.

### Change the authenticated user's username and password together. **Available to:** All authenticated users **Environments:** Live **[Rate Limit](/api/authentication#request-rate-limits-and-time-penalties):** 5 requests per hour, 15-second back-off, counts all requests Changes the username (`name`) and `password` for the calling user in a single request. The request must include the user's `currentPassword` for re-authentication, the new `name` (3–64 characters), and the new `password` (8–64 characters). Omit `userId` to change your own credentials. Organization administrators can change a member's credentials by setting `userId` to the target user; the request is rejected for non-administrators who attempt to target a different user. The username must be unique and is rejected if it is already registered to another user. Some organizations disable username changes for their members; in that case a non-administrator member cannot change the username. The new password is validated against the password policy and is also checked against known data breaches — if the password (or password and email together) appears in a breach, the request is rejected and `hibpHint` indicates which check failed (`PasswordCompromised` or `EmailAndPasswordCompromised`). On success the response returns a fresh `accessToken` and `expirationTime`; the change rotates the access token, so update the token your client uses for subsequent requests. To change only the password, use [`modifyPassword`](/api/rest-api-endpoints/users/modify-password). **Common Failure Scenarios** - `currentPassword` does not match the user's current password. - The requested `name` is already registered to another user. - The organization does not allow members to change their username. - The new `password` fails the password-policy check or appears in a known data breach. - A non-administrator sets `userId` to a user other than themselves. **Error Messages** | `errorText` | Trigger | |-------------|---------| | `Incorrect current password` | `currentPassword` does not match the user's current password. | | `Username is already registered. Please select a new username.` | The requested `name` is taken by another user. | | `Username change is not allowed for this organization` | The organization disables username changes for members. | | `Password has been compromised in a data breach. Please choose different password` | The new password appears in a known data breach. | | `Your password and email has been compromised in a data breach. Please choose different password` | The new password and email appear together in a known data breach. | | `Password should not include username` | The new password contains the username. | | `Password should not include email` | The new password contains the email address. | | `Password should not include 1234, tradovate, ninjatrader, qwerty or abcd` | The new password contains a common sequence. | | Non-empty `errorText` | The request failed; the field describes the reason. |

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Request

This endpoint expects an object.

namestringRequired3-64 characters

passwordstringRequired8-64 characters

currentPasswordstringRequired<=64 characters

userIdlongOptional

Response

AccessTokenResponse

errorTextstring<=8192 characters

Non-empty if the request failed

hibpHintenum

EmailAndPasswordCompromised, PasswordCompromised

accessTokenstring<=8192 characters

expirationTimedatetime

passwordExpirationTimedatetime

userStatusenum

Active, Closed, Initiated, TemporaryLocked, UnconfirmedEmail

userIdlong

namestring<=64 characters

hasLiveboolean

hasSimPlusboolean

showKIDsboolean

$	curl -X POST https://demo.tradovateapi.com/v1/user/modifycredentials \
>	-H "Authorization: Bearer <token>" \
>	-H "Content-Type: application/json" \
>	-d '{
>	"name": "string",
>	"password": "string",
>	"currentPassword": "string"
>	}'

1	{
2	"errorText": "string",
3	"hibpHint": "EmailAndPasswordCompromised",
4	"accessToken": "string",
5	"expirationTime": "2024-01-15T09:30:00Z",
6	"passwordExpirationTime": "2024-01-15T09:30:00Z",
7	"userStatus": "Active",
8	"userId": 1,
9	"name": "string",
10	"hasLive": true,
11	"hasSimPlus": true,
12	"showKIDs": true
13	}