Sign in
accounts

Issue a credential-establishment authority for another account.

Changed on

Administrator-issued credential reset (human-auth ADR § Recovery). A credential-reset holder mints a single-use, hashed, expiring credential-establishment authority for a target, returned once and transmitted out of band. The reset advances the target's session generation and revokes its sessions in the same transaction.

Org-scoped credential-reset reaches only a target whose grants lie entirely within that org and who holds no instance capability; the org-bounded test is evaluated in one serializable transaction with the target's grant set (a concurrent grant landing conflicts with the in-flight reset). A target holding an instance capability has no network reset path at all — break-glass only. This route dispatches between the org-scoped and instance-scoped credential-reset operations by that classification. Every failure that could enumerate the target — an unknown or non-human principal, a caller lacking credential-reset, an org-P holder reaching an org-O target, and a target holding an instance capability (break-glass only) — answers a single uniform 401; the true cause is durable in the audit trail, never on the wire.

post/api/v1/accounts/{principal}/credential-reset

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/accounts/{principal}/credential-reset
  • Auth: HTTP bearer

Response

A session-less credential-establishment authority, returned once.

authoritystring required

The single-use credential-establishment authority for the target, returned once. Issuing it creates no session. It establishes a password, or an OIDC/OAuth2 identity through a claim start when the target holds no credential of any kind. Hand it to the target out of band. Recovery-issued authorities establish only a password.

expires_atstring date-time required

RFC 3339 UTC, microsecond precision.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status