1. Docs
  2. API Reference
  3. Set an identity's password (admin)

Set an identity's password (admin)

POST/api/v1/identities/{id}/password

Sets an identity's password directly (server-to-server admin), primarily for migrating users off a legacy store without the user present. Reuses the argon2id + HaveIBeenPwned path, so a breached password returns 400; the prior hash is recorded to password history, any active failed-login lockout is cleared, and the identity's active sessions are revoked so a rotated credential can't keep a stale session alive. Returns 204 No Content; returns 404 when the identity has no membership in this Environment.

Authentication

Bearer TokenAuthorization Option A

JWT access token

API KeyX-API-Key Option B

API key for management-tier access

Path Parameters

idstring Required

Request body

application/json

passwordstring Required

New password (8–64 chars). NIST SP 800-63B aligned — no composition rules. HaveIBeenPwned breach check runs server-side.

max length 64

Responses

Password set. The identity's existing sessions are revoked and any active failed-login lockout is cleared; the new password takes effect on next sign-in. Intended for backend/admin tooling (e.g. migrating users off a legacy store).

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*
Request
curl -X POST "https://auth.canopy-io.com/api/v1/identities/value/password" \
  -H "X-API-Key: $CANOPY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "password": "string"
  }'
Response
HTTP/1.1 204 Password set. The identity's existing sessions are revoked and any active failed-login lockout is cleared; the new password takes effect on next sign-in. Intended for backend/admin tooling (e.g. migrating users off a legacy store).

(empty body)
 Related endpoints
GETList identities in Application
POSTCreate an identity
GETList identities with their role assignments
GETGet Application identities summary
POSTBulk-create identities
GETGet an identity
PATCHUpdate an identity
DELETERemove an identity
GETGet identity detail with role assignments
POSTActivate an identity
POSTDeactivate an identity
POSTForce a password reset for an identity (admin)
POSTRevoke all of an identity's sessions (admin)
GETGet MFA enrollment summary for an identity
POSTForce-reset an identity's MFA — admin recovery action
GETRead an identity's auth state for backend decisioning
POSTMark an identity's email verified (admin)
GETGet identity's role assignments
GETGet identity's effective permissions
GETGet where an identity holds each permission
 Was this page helpful?

Tell us how we can improve this guide.

Canopy