Force a password reset
POST /v1/users/{user_id}:force-password-reset · permission user-credentials:write
Requires the user to choose a new password: after their next successful password sign-in they cannot continue until they set a new password. The current password hash is not deleted: the user signs in with it once more and then sets a new one. Calling it again is safe: if the user is already flagged, the time of the first flag is kept. The action is written to the management audit log (user.password_reset_forced) and emits the password_reset.scheduled event. To flag many users at once, use Create a bulk password reset job.
The request has no body (send none, or {}). Send an Idempotency-Key header to make retries safe.
Request
| Parameter | In | Required | Description |
|---|---|---|---|
user_id |
path | yes | User id, prefixed usr_. |
Response
204 No Content.
Errors
Every error is an application/problem+json body with a stable code.
| HTTP | code |
When |
|---|---|---|
| 400 | malformed_request, unknown_field |
The body is not valid JSON or has an unknown field. |
| 401 | unauthenticated |
The API key is missing, invalid or revoked. |
| 403 | insufficient_permissions |
The key lacks the user-credentials:write permission. |
| 404 | not_found |
The user does not exist in this environment (or the id is malformed). |
| 409 | conflict |
The user has no password. |
| 429 | rate_limited |
The rate limit was exceeded; honor Retry-After. |
| 503 | service_unavailable |
A dependency is temporarily unavailable; retry later. |
Example
curl -X POST https://api.eu.keenauth.com/v1/users/usr_01h455vb4pex5vsknk084sn02q:force-password-reset \
-H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
-H "Idempotency-Key: $(uuidgen)"
CLI: keenauth users force-password-reset usr_01h455vb4pex5vsknk084sn02q