Change the authenticated user's username and password together.

Available to: All authenticated users

Environments: Live

Rate Limit: 5 requests per hour, 15-second back-off, counts all requests

Changes the username (name) and password for the calling user in a single request. The request must include the user's currentPassword for re-authentication, the new name (3–64 characters), and the new password (8–64 characters).

Omit userId to change your own credentials. Organization administrators can change a member's credentials by setting userId to the target user; the request is rejected for non-administrators who attempt to target a different user.

The username must be unique and is rejected if it is already registered to another user. Some organizations disable username changes for their members; in that case a non-administrator member cannot change the username. The new password is validated against the password policy and is also checked against known data breaches — if the password (or password and email together) appears in a breach, the request is rejected and hibpHint indicates which check failed (PasswordCompromised or EmailAndPasswordCompromised).

On success the response returns a fresh accessToken and expirationTime; the change rotates the access token, so update the token your client uses for subsequent requests. To change only the password, use modifyPassword.

Common Failure Scenarios

• currentPassword does not match the user's current password.
• The requested name is already registered to another user.
• The organization does not allow members to change their username.
• The new password fails the password-policy check or appears in a known data breach.
• A non-administrator sets userId to a user other than themselves.

Error Messages