---
title: "Rotate the PocketBase superuser password"
method: POST
path: "/apps/{appRef}/data/reset-superuser"
tags: ["Data"]
---

# Rotate the PocketBase superuser password

`POST /apps/{appRef}/data/reset-superuser`

## Request

- Base URL: `https://api.percher.run`
- URL: `https://api.percher.run/apps/{appRef}/data/reset-superuser`
- Auth: HTTP bearer

Generates a new PB superuser password, re-injects it as the encrypted `POCKETBASE_ADMIN_PASSWORD` env var, and updates the latest deployment's stored credential so subsequent /apps/{appRef}/data/* calls keep working. By default the response only contains the rotation confirmation and email — the plaintext password never appears in the response body. Pass `?reveal=true` to additionally return the plaintext once (same one-time-show pattern as token creation). Audit log records method/path/status/userId only, never response bodies, so revealed plaintext does not land in /var/log.

## Path parameters

- `appRef` string, required

## Query parameters

- `reveal` boolean

## Response `200`

Rotation succeeded. `password` is present only when `?reveal=true` was set.

- object
  - `message` string, required
  - `email` string, email, required
  - `password` string: Plaintext PB superuser password. Present only when invoked with `?reveal=true`.

## Other responses

- `400`: App is not configured for PocketBase (NOT_POCKETBASE)
- `500`: Failed to create or reset superuser (PB_SUPERUSER_FAILED)
- `503`: PocketBase sidecar is not running (PB_NOT_RUNNING)

---

[API](https://skmtc.dev/percher/apis/percher-api.md) · [All operations](https://skmtc.dev/percher/apis/percher-api/llms.txt) · [OpenAPI document](https://skmtc.dev/percher/apis/percher-api/revisions/d9e7089c21e5?raw)