Reset password for a user in this organization

POST

/api/v1/organizations/{id}/users/{userId}/reset-password

curl --request POST \
  --url http://localhost:3000/api/v1/organizations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/reset-password \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --data '{ "password": "example", "sendEmail": true, "reason": "example" }'

• Development
• Production

Triggers a password reset for a user that is a member of this organization. Allowed for tenant admins (USERS_WRITE) and superadmins. The target user receives a Keycloak UPDATE_PASSWORD email and is required to change their password on next login. Refuses self-reset (use the profile security page instead) and reset for inactive users.

Authorizations

• api-key
• bearer

Parameters

Path Parameters

id

required

string format: uuid

Organization UUID

userId

required

string format: uuid

User UUID

Request Body ^required

Media type application/json

object

password

New password (if not provided, a random password will be generated)

string

sendEmail

required

Send reset email notification to user

boolean

default: true

reason

Reason for resetting the password

string

Responses

200

Password reset triggered

Media type application/json

object

success

required

Whether the password reset itself succeeded

boolean

temporaryPassword

Temporary password (only included if generated)

string

mustChangePassword

required

User must change password on next login

boolean

emailSent

Whether a reset email was actually sent. False when the user has no linked Keycloak account, Keycloak sync is disabled, or the send failed (FM-602 S2).

boolean

emailError

Why the email was not sent, when emailSent is false (e.g. ‘no-keycloak-account’, ‘keycloak-sync-disabled’, ‘keycloak-send-failed’).

string

Example ^generated

{
  "success": true,
  "temporaryPassword": "example",
  "mustChangePassword": true,
  "emailSent": true,
  "emailError": "example"
}

400

Self-reset attempted or user is not active

401

Unauthorized

403

Forbidden — caller lacks USERS_WRITE in this org

404

User is not a member of this organization