---
title: "Change user password"
type: reference
method: POST
path: /rest-api/user-preference/change-password.do
tag: "Users"
---

# Change user password

`POST https://YOUR-NETWORK-DOMAIN/rest-api/user-preference/change-password.do`

Changes the password for the currently authenticated user. The caller must provide the current password for verification, plus a new password and its confirmation which must match. All three password fields are validated against the password length policy. If the current password does not match, a 400 error is returned. On success, the new password is saved. Requires an authenticated user.

## Form params

| Name | Type | Required | Example | Description |
|---|---|---|---|---|
| `confirmPassword` | string | no | `n3wP@ss456` | Confirmation of the new password (must match newPassword) |
| `currentPassword` | string | no | `0ldP@ss123` | The user's current password for verification |
| `newPassword` | string | no | `n3wP@ss456` | The new password to set (must meet password policy requirements) |

## Responses

- `200` — Password changed successfully. Response: {success: true}
- `400` — Bad request — current password mismatch, or new/confirm passwords do not match
- `401` — Unauthorized — authentication error
- `403` — Forbidden — insufficient permissions

## Example request

```bash
curl --request POST \
  --url 'https://YOUR-NETWORK-DOMAIN/rest-api/user-preference/change-password.do' \
  --header 'X-Api-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'confirmPassword=n3wP@ss456' \
  --data-urlencode 'currentPassword=0ldP@ss123' \
  --data-urlencode 'newPassword=n3wP@ss456'
```

Source: https://epom.com/ad-server/docs/api/users/post-user-preference-change-password