---
title: "Create password verification record"
method: POST
path: "/api/experience/verification/password"
tags: ["Experience"]
---

# Create password verification record

`POST /api/experience/verification/password`

Create and verify a new Password verification record. The verification record can only be created if the provided user credentials are correct. If the password has expired under the password expiration policy, the request is rejected with `password.expired` and the user must reset their password before continuing.

## Request body

- object
  - `identifier` object, required — The unique identifier of the user that will be used to identify the user along with the provided password.
    - `type` 'username' | 'email' | 'phone', required
    - `value` string, required
  - `password` string, required — The user password.

## Response `200`

The Password verification record has been successfully created and verified.

- object
  - `verificationId` string, required — The unique verification ID of the newly created Password verification record. The `verificationId` is required when verifying the user's identity via the `Identification` API.

## Other responses

- `400` — The verification attempts have exceeded the maximum limit.
- `401` — The user is suspended or banned from the service.
- `409` — Conflict
- `422` — `session.invalid_credentials:` Either the user is not found or the provided password is incorrect. <br/>`password.expired:` The password is valid but already expired.

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/revisions/a163dc77d842/schema)