Modify Password

POST

/user/modifypassword

Change the authenticated user’s password.

Available to: All authenticated users

Environments: Live

Rate Limit: 5 requests per hour, 15-second back-off, counts failed requests only

Changes the password for the calling user. The request must include the user’s currentPassword (re-authentication) and the new password. The new password is validated against the password policy before it is applied.

Omit userId to change your own password. Organization administrators can change a member’s password by setting userId to the target user; the request is rejected for non-administrators who attempt to target a different user.

The new password must be 8–64 characters. It is rejected if it contains the username, contains the email address, or contains a common sequence (1234, tradovate, ninjatrader, qwerty, or abcd).

On success the response returns a fresh accessToken and expirationTime — the password change rotates the access token, so update the token your client uses for subsequent requests. To change the username at the same time as the password, use modifyCredentials instead.

Common Failure Scenarios

currentPassword does not match the user’s current password.
The new password fails the password-policy check (too short, or contains the username, email, or a common sequence).
A non-administrator sets userId to a user other than themselves.

Error Messages

`errorText`	Trigger
`Incorrect current password`	`currentPassword` does not match the user’s current password.
`Password should not include username`	The new password contains the username.
`Password should not include email`	The new password contains the email address.
`Password should not include 1234, tradovate, ninjatrader, qwerty or abcd`	The new password contains a common sequence.
Non-empty `errorText`	The request failed; the field describes the reason.

### Change the authenticated user's password. **Available to:** All authenticated users **Environments:** Live **[Rate Limit](/api/authentication#request-rate-limits-and-time-penalties):** 5 requests per hour, 15-second back-off, counts failed requests only Changes the password for the calling user. The request must include the user's `currentPassword` (re-authentication) and the new `password`. The new password is validated against the password policy before it is applied. Omit `userId` to change your own password. Organization administrators can change a member's password by setting `userId` to the target user; the request is rejected for non-administrators who attempt to target a different user. The new `password` must be 8–64 characters. It is rejected if it contains the username, contains the email address, or contains a common sequence (`1234`, `tradovate`, `ninjatrader`, `qwerty`, or `abcd`). On success the response returns a fresh `accessToken` and `expirationTime` — the password change rotates the access token, so update the token your client uses for subsequent requests. To change the username at the same time as the password, use [`modifyCredentials`](/api/rest-api-endpoints/users/modify-credentials) instead. **Common Failure Scenarios** - `currentPassword` does not match the user's current password. - The new `password` fails the password-policy check (too short, or contains the username, email, or a common sequence). - A non-administrator sets `userId` to a user other than themselves. **Error Messages** | `errorText` | Trigger | |-------------|---------| | `Incorrect current password` | `currentPassword` does not match the user's current password. | | `Password should not include username` | The new password contains the username. | | `Password should not include email` | The new password contains the email address. | | `Password should not include 1234, tradovate, ninjatrader, qwerty or abcd` | The new password contains a common sequence. | | Non-empty `errorText` | The request failed; the field describes the reason. |

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Request

This endpoint expects an object.

passwordstringRequired8-64 characters

currentPasswordstringRequired<=64 characters

userIdlongOptional

Response

AccessTokenResponse

errorTextstring<=8192 characters

Non-empty if the request failed

hibpHintenum

EmailAndPasswordCompromised, PasswordCompromised

accessTokenstring<=8192 characters

expirationTimedatetime

passwordExpirationTimedatetime

userStatusenum

Active, Closed, Initiated, TemporaryLocked, UnconfirmedEmail

userIdlong

namestring<=64 characters

hasLiveboolean

hasSimPlusboolean

showKIDsboolean

$	curl -X POST https://demo.tradovateapi.com/v1/user/modifypassword \
>	-H "Authorization: Bearer <token>" \
>	-H "Content-Type: application/json" \
>	-d '{
>	"password": "string",
>	"currentPassword": "string"
>	}'

1	{
2	"errorText": "string",
3	"hibpHint": "EmailAndPasswordCompromised",
4	"accessToken": "string",
5	"expirationTime": "2024-01-15T09:30:00Z",
6	"passwordExpirationTime": "2024-01-15T09:30:00Z",
7	"userStatus": "Active",
8	"userId": 1,
9	"name": "string",
10	"hasLive": true,
11	"hasSimPlus": true,
12	"showKIDs": true
13	}