CorebanqCorebanq Developer Docs
Usersv1Password

Change password

Change user password Note {id} is NOT validated here: ChangePassword calls uuid.MustParse on it, so a malformed id panics and middleware.Recoverer answers a bare 500 with an EMPTY body rather than the Error envelope documented below.

PUT
/v1/users/{id}/password

Authorization

bearerAuth
AuthorizationBearer <token>

In: header

Path Parameters

id*string

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PUT "https://example.com/v1/users/497f6eca-6276-4993-bfeb-53cbbbba6f08/password" \  -H "Content-Type: application/json" \  -d '{    "current_password": "string",    "new_password": "string"  }'
{
  "status": 200,
  "message": "string"
}
{
  "status": 400,
  "message": "Invalid user input",
  "code": "users_m.invalid_user_input",
  "class": "validation"
}
{
  "status": 401,
  "message": "Unauthorized",
  "code": "common.unauthorized",
  "class": "business"
}
{
  "status": 403,
  "message": "No access to the record",
  "code": "common.rbac_no_rec_access",
  "class": "business"
}

{
  "status": 429,
  "message": "Rate limit for 203.0.113.10 to 456e1234-e89b-12d3-a456-426614174111 exceeded.",
  "code": "rate_limits_m.exceeded",
  "class": "temporary",
  "retryable": true
}

{
  "status": 500,
  "message": "Internal server error",
  "code": "common.server_error",
  "class": "business"
}

{
  "overall_status": "unhealthy",
  "message": "Service is shutting down",
  "timestamp": "2026-08-27T15:04:05Z"
}

POSTReset password

AUTHENTICATED BY X-API-Key, not by a bearer token. auth.APIKeyMiddleware REPLACES the usual chain on this route, so there is no user context, no RBAC check and no licence check — and the refusals are common.api_key_required / common.invalid_api_key rather than common.unauthorized / common.rbac_no_rec_access. An OPTIONS request skips the key check entirely. Complete a password reset using the token from the reset email. Subject to IP rate limiting (max attempts per 15 minutes; invalid tokens increment the failed-attempt window per hour). Cache errors fail closed with 503.

POSTActivate regular user account

AUTHENTICATED BY X-API-Key, not by a bearer token. auth.APIKeyMiddleware REPLACES the usual chain on this route, so there is no user context, no RBAC check and no licence check — and the refusals are common.api_key_required / common.invalid_api_key rather than common.unauthorized / common.rbac_no_rec_access. An OPTIONS request skips the key check entirely. Activate invited user account and set password (public endpoint, API key only). Requires invitation token, password policy compliance, and terms/privacy acceptance. Activation runs in a transaction (user activation, password, metadata merge, RBAC grants); on invariant failure (e.g. missing email credential row after validation) the server responds 422 with users_m.email_credential_not_found.