---
title: "Change password"
method: POST
path: "/api/v1/auth/password/change"
tags: ["User"]
---

# Change password

`POST /api/v1/auth/password/change`

Change password of current user.

Due to security reasons, user passwords cannot be set directly using the
standard CRUD operations. Instead, the following endpoints can be used for
resetting and changing passwords.

Password requirements:
* Length: 12–64 characters
* May not be similar to username
* May not contain common words
* May not be numeric only
* Must pass complexity check

## Request body

- PasswordChange
  - `new_password1` string, required — New password
  - `new_password2` string, required — New password confirmation (must match new_password1)
  - `old_password` string, required — Current password

## Response `200`

OK

- User
  - `id` integer, required — ID of the user
  - `url` string, uri, required — URL of the user
  - `first_name` string, required — First name of the user
  - `last_name` string, required — Last name of the user
  - `email` string, email, required — Email of the user
  - `phone_number` string, nullable, required — Phone number of the user
  - `password` string, required — Password (not shown on API)
  - `date_joined` string, date-time, required — Date of user join
  - `username` string, required — Username of a user
  - `groups` string[], required — List of [user role](/api/user-role) (permission groups)
  - `organization` string, uri, required — Organization URL.
  - `queues` string[], required — List of queues user is assigned to
  - `is_active` boolean, required — Whether user is enabled or disabled
  - `last_login` string, date-time, nullable, required — Date of last login
  - `ui_settings` object, required — User-related frontend UI settings (e.g. locales). Rossum internal.
  - `metadata` Metadata, required — Client data. May be used to store e.g. external system object IDs. See [Metadata](/guides/overview#metadata) for more details.
  - `oidc_id` string, nullable, required — OIDC provider id used to match Rossum user (displayed only to admin user)
  - `auth_type` 'sso' | 'password', required — Authorization method, can be `sso` or `password`. This field can be edited only by admin.
  - `deleted` boolean, required — Whether a user is deleted

## Other responses

- `400` — Invalid input data.
- `401` — The username/password is invalid or token is invalid (e.g. expired).
- `403` — Insufficient permission, missing authentication, invalid CSRF token and similar issue.
- `404` — The specified resource was not found.
- `409` — Conflict
- `413` — Payload too large (especially for files uploaded).
- `429` — Request rate is too high, wait before sending more requests. See [Rate Limiting](/guides/overview#rate-limiting) for more details.
- `500` — Server failure while processing the request.
- `502` — Invalid response from the upstream server.
- `503` — We're temporarily offline for maintenance. Please try again later.
- `504` — Upstream server could not complete the request in time.

---

[API](https://skmtc.dev/rossum/apis/rossum-api.md) · [All operations](https://skmtc.dev/rossum/apis/rossum-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/rossum/rossum-api/revisions/f1b5a910991d/schema)