---
title: "Activate User"
method: POST
path: "/api/noauth/activate"
tags: ["auth-controller"]
---

# Activate User

`POST /api/noauth/activate`

Checks the activation token and updates corresponding user password in the database. Now the user may start using his password to login. The response already contains the [JWT](https://jwt.io) activation and refresh tokens, to simplify the user activation flow and avoid asking user to input password again after activation. If token is valid, returns the object that contains [JWT](https://jwt.io/) access and refresh tokens. If token is not valid, returns '400 Bad Request'.

## Query parameters

- `sendActivationMail` boolean

## Request body

- ActivateUserRequest — Activate user request.
  - `activateToken` string — The activate token to verify
  - `password` string — The new password to set

## Response `200`

OK

- JwtPair — JWT Pair
  - `token` string — The JWT Access Token. Used to perform API calls.
  - `refreshToken` string — The JWT Refresh Token. Used to get new JWT Access Token if old one has expired.
  - `scope` 'SYS_ADMIN' | 'TENANT_ADMIN' | 'CUSTOMER_USER' | 'REFRESH_TOKEN' | 'PRE_VERIFICATION_TOKEN' | 'MFA_CONFIGURATION_TOKEN'

---

[API](https://skmtc.net/thingsboard/apis/thingsboard-rest-api.md) · [All operations](https://skmtc.net/thingsboard/apis/thingsboard-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/thingsboard/thingsboard-rest-api/revisions/40169ccdec5c/schema)