---
title: "Change the caller's own password (dashboard-scoped)"
method: POST
path: "/dashboard/account/password"
tags: ["Auth"]
---

# Change the caller's own password (dashboard-scoped)

`POST /dashboard/account/password`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/dashboard/account/password`
- Auth: API key in cookie `token`

Dashboard-only (src/routes/account.ts, T712/T748) -- listed here for reference alongside the other password-setting endpoints even though internal/admin/dashboard routes are otherwise out of this document's scope (see the top-level description) and this route is exempt from the drift guard (`scripts/check-openapi-drift.ts`'s `EXEMPT_ROUTE_FILES`). Requires the current password; on success, rotates the caller's own session and revokes every other login lineage.

## Request body

- object
  - `currentPassword` string, required
  - `newPassword` string, required: NIST SP 800-63B Rev.4 split floor (T748), resolved server-side per account the same way as POST /auth/reset-password: 8 chars if the caller has a CONFIRMED `user_mfa` row, 15 otherwise. The 8 here is only the structural floor shared with the MFA-enrolled branch -- a password-only account is rejected with `password_too_short` below 15 chars even though this schema accepts 8. Also checked against the HIBP breached-password corpus (fails open on an HIBP outage).

## Response `200`

Password changed. Fresh session cookies set for the caller's own device.

- object
  - `message` string

## Other responses

- `400`: Validation failure, wrong current password (generic `invalid_credentials`, anti-enumeration), `password_too_short`, or `password_breached`.
- `401`: Missing or invalid credentials.
- `429`: Rate limit exceeded for this endpoint.

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)