Skip to navigation
REST API EndpointsUsers

Modify Password

View as Markdown

Change the authenticated user’s password.

Available to: All authenticated users

Environments: Live

Rate Limit: 5 requests per hour, 15-second back-off, counts failed requests only

Changes the password for the calling user. The request must include the user’s currentPassword (re-authentication) and the new password. The new password is validated against the password policy before it is applied.

Omit userId to change your own password. Organization administrators can change a member’s password by setting userId to the target user; the request is rejected for non-administrators who attempt to target a different user.

The new password must be 8–64 characters. It is rejected if it contains the username, contains the email address, or contains a common sequence (1234, tradovate, ninjatrader, qwerty, or abcd).

On success the response returns a fresh accessToken and expirationTime — the password change rotates the access token, so update the token your client uses for subsequent requests. To change the username at the same time as the password, use modifyCredentials instead.

Common Failure Scenarios

  • currentPassword does not match the user’s current password.
  • The new password fails the password-policy check (too short, or contains the username, email, or a common sequence).
  • A non-administrator sets userId to a user other than themselves.

Error Messages

errorTextTrigger
Incorrect current passwordcurrentPassword does not match the user’s current password.
Password should not include usernameThe new password contains the username.
Password should not include emailThe new password contains the email address.
Password should not include 1234, tradovate, ninjatrader, qwerty or abcdThe new password contains a common sequence.
Non-empty errorTextThe request failed; the field describes the reason.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Request

This endpoint expects an object.
passwordstringRequired8-64 characters
currentPasswordstringRequired<=64 characters
userIdlongOptional

Response

AccessTokenResponse
errorTextstringOptional<=8192 characters

Non-empty if the request failed

hibpHintenumOptional
EmailAndPasswordCompromised, PasswordCompromised
Allowed values:
accessTokenstringOptional<=8192 characters
expirationTimedatetimeOptional
passwordExpirationTimedatetimeOptional
userStatusenumOptional
Active, Closed, Initiated, TemporaryLocked, UnconfirmedEmail
Allowed values:
userIdlongOptional
namestringOptional<=64 characters
hasLivebooleanOptional
ownsUnarchivedLivebooleanOptional
hasApprovedTradingPermissionbooleanOptional
hasSimPlusbooleanOptional
showKIDsbooleanOptional