---
title: "Replace the password of a user"
method: PUT
path: "/api/v2/users/{userId}/password"
tags: ["Users"]
---

# Replace the password of a user

`PUT /api/v2/users/{userId}/password`

> 🔑
>
> Required OAuth scope: `users:write`.

Replaces the password of a user with the provided data. If 'passwordMustBeChanged' is set to true, the user will be forced to change their password on the next login.

## Path parameters

- `userId` string, ObjectId, required

## Headers

- `360-api-version` 'v2.0', required

## Request body

- ReplacePasswordBody
  - `password` string, required — The new password of the given user. The new password must be at least 8 characters long and it might be subject to company based rules. Example: 'password' : 'my_s3cret.PAssw0rd'.
  - `passwordMustBeChanged` boolean, required — True if the user must change their password when first logging into the platform; false otherwise.

## Response `204`

Replaces the password of a user with the provided data.

## Other responses

- `400` — The server cannot or will not process the request due to something that is perceived to be a client error.
- `401` — The given access token is either missing, invalid, has expired, or has been revoked.
- `403` — The given access token does not have the required OAuth scope to execute the request.
- `404` — The given `userId` does not correspond to any existing user.
- `429` — The client has sent too many requests in a short amount of time.

---

[API](https://skmtc.net/360learning/apis/core-api.md) · [All operations](https://skmtc.net/360learning/apis/core-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/360learning/core-api/versions/94b691b0b72c/schema)