Auth

Set Password

First-time password set for accounts that came in through an OAuth provider (Google today) and don't yet have a local password.

Rejects with 409 if a password already exists — the user must go through /auth/change-password in that case, which requires the current password. This asymmetry is the whole point: we do NOT want a compromised Google session to be able to silently reset a real password without knowing the current one.

Fires the same password_changed security notification the reset and change flows use, so the user gets an audit-trail email even for a first-time password set.

post/api/v1/auth/set-password

Request

  • Base URL: https://api.africadb.com (the document declares no server; this is the origin it was published from)
  • URL: https://api.africadb.com/api/v1/auth/set-password
  • Auth: none declared

Request body

new_passwordstring required

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.