---
title: "Change another user's password (admin only)."
method: PATCH
path: "/api/v1/user/{user}/change-password"
---

# Change another user's password (admin only).

`PATCH /api/v1/user/{user}/change-password`

**Authentication**: JWT token required
**Authorization**: Admin level access required (ADMIN or SUPERADMIN)
**Security**: Admin password reset without requiring old password

**Path Parameters**:
- `user`: User identifier (email address or numeric ID) for password change

**Request Schema**:
```json
{
  "new_password": "newSecurePassword123"
}
```

**Request Fields**:
- `new_password`: New password to set for the user (required)

**Response Schema**:
```json
{
  "data": {
    "id": "user-456",
    "email": "user@example.com",
    "name": "John Doe",
    "role": "USER",
    "created_at": "2025-01-15T10:30:00Z",
    "updated_at": "2025-01-15T15:00:00Z",
    "password_last_changed": "2025-01-15T15:00:00Z",
    "password_changed_by": "admin-123"
  }
}
```

**Administrative Features**:
- Does not require user's current password
- Updates password change timestamp
- Records which admin performed the change
- Enforces same password strength requirements
- Invalidates user's existing sessions for security

**Security Considerations**:
- Action is logged for audit purposes
- User receives notification of password change
- All user's active sessions are terminated
- Password must meet system security requirements

**Use Cases**:
- Emergency account recovery for locked users
- Password reset for users who forgot credentials
- Security incident response
- Administrative account maintenance

**Audit Logging**:
- Records admin user who changed password
- Timestamps the password change event
- Maintains audit trail for compliance
- May trigger security notifications

**Error Responses**:
- `400 Bad Request`: Missing new_password field
- `401 Unauthorized`: JWT token required
- `403 Forbidden`: Admin access required, or ADMIN trying to change
  SUPERADMIN password
- `404 Not Found`: User does not exist
- `422 Unprocessable Entity`: Password doesn't meet requirements
- `500 Internal Server Error`: Password change failed

## Path parameters

- `user` string, required

## Request body

- object

## Response `200`

Success

- object

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

---

[API](https://skmtc.dev/trends/apis/trends-earth-api.md) · [All operations](https://skmtc.dev/trends/apis/trends-earth-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trends/trends-earth-api/revisions/6bdbc0b84666/schema)