---
title: "Configure the password policy"
method: PUT
path: "/api/{org_id}/settings/password_policy"
tags: ["Organizations"]
---

# Configure the password policy

`PUT /api/{org_id}/settings/password_policy`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/{org_id}/settings/password_policy`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/:org_id/settings/password_policy/put.ts> (a function with typed inputs; its response is checked against the schema)

Replaces the whole policy; any field omitted from the body falls back to its default rather than to its current value. Requires Root or Admin on the meta organization. If the complexity requirements grew, every native user is flagged for a forced password reset and the response reports how many were affected — root, external users and service accounts are never flagged.

## Path parameters

- `org_id` string, required

## Request body

- PasswordPolicy: The resolved instance-wide policy.
  - `apply_to_root` boolean: Whether root is held to rotation and lockout like every other native user. Default `false`, which is the documented exemption: root is the only account that can repair a misconfigured policy, and the only one whose lockout has no remedy from inside the product. Complexity and reuse already apply to root at password-set time whatever this says; the tightening sweep never touches root either way, so root is never mass-flagged.
  - `cookie_max_age_secs` integer: How long a sign-in cookie stays valid, in seconds. `0` defers to `ZO_COOKIE_MAX_AGE`. This is the browser's copy of the credential, not a server-side session: shortening it makes the browser stop sending the cookie sooner, and does nothing to a copy taken from it. It applies from the next sign-in — cookies already issued keep the lifetime they were given.
  - `history_count` integer: `0` disables reuse prevention.
  - `history_max_retained` integer: Hashes retained per user; kept at or above `history_count` so a later increase to `history_count` has history to check against.
  - `lockout` LockoutPolicy: Failed-login lockout knobs.
    - `backoff` 'linear' | 'exponential': How lockout duration grows with each successive lockout.
    - `bucket_size` integer: Failed attempts before each subsequent lockout. `0` reuses `threshold`.
    - `max_secs` integer
    - `start_secs` integer
    - `threshold` integer: Failed attempts before the first lockout. `0` disables lockout entirely.
  - `max_length` integer: Between `min_length` and 128; a stored legacy `0` still reads as unbounded.
  - `min_length` integer
  - `require_digit` boolean
  - `require_lowercase` boolean
  - `require_special` boolean
  - `require_uppercase` boolean
  - `rotation_days` integer: `0` disables rotation enforcement.
  - `rotation_warning_days` integer: Days before expiry to start warning. `0` = never warn; equal to `rotation_days` = warn on every request, since no live password is then outside the window.
  - `special_char_set` string: Empty means any non-alphanumeric character counts as special.

## Response `200`

Success

- SetPasswordPolicyResponse: A tightening write forces a password reset on every affected user, so the count comes back with the policy rather than leaving the admin to discover the blast radius from support tickets.
  - `policy` PasswordPolicy, required: The resolved instance-wide policy.
    - `apply_to_root` boolean: Whether root is held to rotation and lockout like every other native user. Default `false`, which is the documented exemption: root is the only account that can repair a misconfigured policy, and the only one whose lockout has no remedy from inside the product. Complexity and reuse already apply to root at password-set time whatever this says; the tightening sweep never touches root either way, so root is never mass-flagged.
    - `cookie_max_age_secs` integer: How long a sign-in cookie stays valid, in seconds. `0` defers to `ZO_COOKIE_MAX_AGE`. This is the browser's copy of the credential, not a server-side session: shortening it makes the browser stop sending the cookie sooner, and does nothing to a copy taken from it. It applies from the next sign-in — cookies already issued keep the lifetime they were given.
    - `history_count` integer: `0` disables reuse prevention.
    - `history_max_retained` integer: Hashes retained per user; kept at or above `history_count` so a later increase to `history_count` has history to check against.
    - `lockout` LockoutPolicy: Failed-login lockout knobs.
      - `backoff` 'linear' | 'exponential': How lockout duration grows with each successive lockout.
      - `bucket_size` integer: Failed attempts before each subsequent lockout. `0` reuses `threshold`.
      - `max_secs` integer
      - `start_secs` integer
      - `threshold` integer: Failed attempts before the first lockout. `0` disables lockout entirely.
    - `max_length` integer: Between `min_length` and 128; a stored legacy `0` still reads as unbounded.
    - `min_length` integer
    - `require_digit` boolean
    - `require_lowercase` boolean
    - `require_special` boolean
    - `require_uppercase` boolean
    - `rotation_days` integer: `0` disables rotation enforcement.
    - `rotation_warning_days` integer: Days before expiry to start warning. `0` = never warn; equal to `rotation_days` = warn on every request, since no live password is then outside the window.
    - `special_char_set` string: Empty means any non-alphanumeric character counts as special.
  - `users_flagged` integer, required

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `500`: Internal Server Error

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)