Auth

Change the caller's own password (dashboard-scoped)

Dashboard-only (src/routes/account.ts, T712/T748) -- listed here for reference alongside the other password-setting endpoints even though internal/admin/dashboard routes are otherwise out of this document's scope (see the top-level description) and this route is exempt from the drift guard (scripts/check-openapi-drift.ts's EXEMPT_ROUTE_FILES). Requires the current password; on success, rotates the caller's own session and revokes every other login lineage.

post/dashboard/account/password

Request

  • Base URL: http://localhost:38200
  • URL: http://localhost:38200/dashboard/account/password
  • Auth: API key in cookie token

Request body

currentPasswordstring required
newPasswordstring required

NIST SP 800-63B Rev.4 split floor (T748), resolved server-side per account the same way as POST /auth/reset-password: 8 chars if the caller has a CONFIRMED user_mfa row, 15 otherwise. The 8 here is only the structural floor shared with the MFA-enrolled branch -- a password-only account is rejected with password_too_short below 15 chars even though this schema accepts 8. Also checked against the HIBP breached-password corpus (fails open on an HIBP outage).

Response

Password changed. Fresh session cookies set for the caller's own device.

messagestring

Changes

No recorded changes to this operation across all 1 revision of this API.