Users

Reset another user's password to a generated temporary one (admin only).

Changed on

The recovery path for a user who lost their password when outbound email is not configured. Every browser session of the user is revoked and they must choose a new password at next sign-in. API keys are deliberately left alone, matching POST /users/me/password: revoking them would silently break the user's automation. The temporary password is returned once and cannot be retrieved again.

Any users:manage principal may reset any other user, including another admin. That is the existing trust model for this permission (it can already delete users and change their roles); only resetting yourself is refused.

post/users/{user_id}/password

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/users/{user_id}/password
  • Auth: HTTP bearer

Path parameters

user_idinteger required

User ID

Response

Password reset; the temporary password is returned once

must_change_passwordboolean required

Always true: the user must choose a new password at next sign-in.

temporary_passwordstring required

Example response

{
  "temporary_password": "Kp7#mW2qRz9!vN4xT8b$"
}

Changes