---
title: "Update user password expiration"
method: PATCH
path: "/api/users/{userId}/password/expiration"
tags: ["Users"]
---

# Update user password expiration

`PATCH /api/users/{userId}/password/expiration`

Update the user's password expiration state for the next sign-in attempt.

## Path parameters

- `userId` string, required

## Request body

- object
  - `isExpired` boolean, required — Whether the user's password should be marked as expired.

## Response `200`

User password expiration state has been updated successfully.

- object
  - `id` string, required
  - `username` string, nullable, required
  - `primaryEmail` string, nullable, required
  - `primaryPhone` string, nullable, required
  - `name` string, nullable, required
  - `avatar` string, nullable, required
  - `customData` object, required — arbitrary
  - `identities` object, required
  - `lastSignInAt` number, nullable, required
  - `createdAt` number, required
  - `updatedAt` number, required
  - `profile` object, required
    - `familyName` string
    - `givenName` string
    - `middleName` string
    - `nickname` string
    - `preferredUsername` string
    - `profile` string
    - `website` string
    - `gender` string
    - `birthdate` string
    - `zoneinfo` string
    - `locale` string
    - `address` object
      - `formatted` string
      - `streetAddress` string
      - `locality` string
      - `region` string
      - `postalCode` string
      - `country` string
  - `applicationId` string, nullable, required
  - `isSuspended` boolean, required
  - `hasPassword` boolean
  - `hasSecurityVerificationMethod` boolean
  - `ssoIdentities` object[]
    - `tenantId` string, required
    - `id` string, required
    - `userId` string, required
    - `issuer` string, required
    - `identityId` string, required
    - `detail` object, required — arbitrary
    - `createdAt` number, required
    - `updatedAt` number, required
    - `ssoConnectorId` string, required
  - `passwordDigest` string, nullable
  - `passwordAlgorithm` 'Argon2i' | 'Argon2id' | 'Argon2d' | 'SHA1' | 'SHA256' | 'MD5' | 'Bcrypt' | 'Legacy', nullable

## Other responses

- `400` — Password expiration policy is not enabled in the sign-in experience settings.
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/versions/a163dc77d842/schema)