Change password

Session-only. Change the account password. Policy: 10–200 characters including an uppercase letter, a lowercase letter, and a digit. Success bumps the account’s token version (every other session is invalidated) and refreshes the current session cookie.

POST /me/password

Change password

cURL

curl --request POST \
  --url https://aropay.aro.media/api/v1/me/password \
  --header 'Content-Type: application/json' \
  --cookie aropay_session= \
  --data '
{
  "currentPassword": "<string>",
  "newPassword": "<string>"
}
'

200

{
  "ok": "<unknown>",
  "data": {
    "user": {
      "id": "<string>",
      "email": "[e-mail]",
      "name": "<string>",
      "company": "<string>",
      "mustChangePassword": true,
      "totpEnabled": true,
      "lastLoginAt": "2023-11-07T05:31:56Z",
      "createdAt": "2023-11-07T05:31:56Z"
    }
  }
}

Authorizations

aropay_session · string · cookie · required

Browser session cookie minted by POST /auth/login (or passkey login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked Session-only accept only this credential and return 403 session_required for API keys.

Body

application/json

currentPassword · string · required

newPassword · string · required

Must include upper, lower, and digit.

Required string length: 10 - 200

Response

200

application/json

Password changed; session refreshed.

ok · any · required

data · object · required

Show child attributes