Change another user's password (admin only).

Authentication: JWT token required Authorization: Admin level access required (ADMIN or SUPERADMIN) Security: Admin password reset without requiring old password

Path Parameters:

• user: User identifier (email address or numeric ID) for password change

Request Schema:

{
  "new_password": "newSecurePassword123"
}

Request Fields:

• new_password: New password to set for the user (required)

Response Schema:

{
  "data": {
    "id": "user-456",
    "email": "user@example.com",
    "name": "John Doe",
    "role": "USER",
    "created_at": "2025-01-15T10:30:00Z",
    "updated_at": "2025-01-15T15:00:00Z",
    "password_last_changed": "2025-01-15T15:00:00Z",
    "password_changed_by": "admin-123"
  }
}

Administrative Features:

• Does not require user's current password
• Updates password change timestamp
• Records which admin performed the change
• Enforces same password strength requirements
• Invalidates user's existing sessions for security

Security Considerations:

• Action is logged for audit purposes
• User receives notification of password change
• All user's active sessions are terminated
• Password must meet system security requirements

Use Cases:

• Emergency account recovery for locked users
• Password reset for users who forgot credentials
• Security incident response
• Administrative account maintenance

Audit Logging:

• Records admin user who changed password
• Timestamps the password change event
• Maintains audit trail for compliance
• May trigger security notifications

Error Responses:

• 400 Bad Request: Missing new_password field
• 401 Unauthorized: JWT token required
• 403 Forbidden: Admin access required, or ADMIN trying to change SUPERADMIN password
• 404 Not Found: User does not exist
• 422 Unprocessable Entity: Password doesn't meet requirements
• 500 Internal Server Error: Password change failed