---
title: "Change the calling user's password."
method: PUT
path: "/api/users/me/password"
tags: ["Users"]
---

# Change the calling user's password.

`PUT /api/users/me/password`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/users/me/password`
- Auth: HTTP bearer

Changes the password of the calling key's own user, which requires the current password. The new password must differ from it. Clears any required change and revokes the user's session keys, including the calling key if it is one; long-lived keys are unaffected. Requires the scope, not an administrator. Recorded as a user_password_changed audit event, without either password. A wrong current password counts toward the user's sign-in lockout, so a key cannot be used to guess the password; while the user is locked, the change is refused with 429. Requires the `users:write` scope.

## Headers

- `Authorization` string, required

## Request body

- ChangePasswordRequest
  - `currentPassword` string: The user's current password.
  - `newPassword` string: At least 16 characters and at most 72 bytes in UTF-8, different from the current password.

## Response `204`

The password was changed.

## Other responses

- `400`: A password is missing, the new password is shorter than 16 characters or longer than 72 bytes in UTF-8, or it is the same as the current one.
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold users:write, or the current password is not correct.
- `404`: Not Found
- `406`: No representation matches Accept.
- `409`: The user has no password yet, so an administrator sets the first one, or the password was changed by a concurrent request.
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `429`: The user is locked after repeated wrong passwords, at sign-in or here. Retry-After gives the seconds to wait.
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-14** `c559ac8cb524`: 1 info
  - added the non-success response with the status `429`
- **2026-10-10** `c4f85daa9208`: 17 info
  - added the non-success response with the status `404`
  - added the optional property `field` to the response with the `400` status
  - added the optional property `field` to the response with the `401` status
  - added the optional property `field` to the response with the `403` status
  - …13 more
- **2026-10-05** `4082c17721d8`: 5 breaking, 5 info
  - removed the media type `*/*` for the response with the status `401`
  - removed the media type `*/*` for the response with the status `413`
  - removed the media type `*/*` for the response with the status `415`
  - removed the media type `*/*` for the response with the status `500`
  - …6 more
- **2026-10-05** `4fa43795fff9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/users/me/password/put.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)