How to Force a Password Reset After Changing a User's Password in FusionAuth

[wesley]

I plan to use the following API call to change a user's password to a default value:

API Endpoint:

POST /api/user/change-password

Example JSON Request:

{
  "applicationId": "12b863f1-f468-4782-9ca1-8753fa8340a7",
  "currentPassword": "long password",
  "loginId": "user@company.com",
  "password": "much longer password"
}

When the user logs in with the default password, I want to force them to reset it. Is there a setting in the JSON request body to indicate that the user should be required to change their password on their next login?

[wesley]

The POST /api/user/change-password endpoint does not support a flag to require a password reset. However, you can achieve this by using the PATCH /api/user/{userId} endpoint and setting the passwordChangeRequired field in the request body.

Here’s an example JSON for the PATCH /api/user/{userId} call:

{
  "user": {
    "passwordChangeRequired": true
  }
}

Alternatively, you can set this requirement manually via the FusionAuth Admin UI:

• Navigate to Users > Manage User > Edit User Dropdown.
• Select Require Password Change.

Documentation for reference:

• Update a User

This ensures the user will be prompted to reset their password upon their next login.