Change the current account's password
const url = 'https://api.aetherpush.com/v1/account/password';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"currentPassword":"example","newPassword":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/account/password \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "currentPassword": "example", "newPassword": "example" }'Dashboard sessions only. Verifies the current password, stores the new
one and signs out the account’s other browser sessions; the calling
session, CLI credentials and named access keys stay. Outstanding
password-reset links and pending CLI authorization requests are voided
in the same transaction. The second factor is untouched. A wrong
current password answers 400 with a field error rather than 401, so a
signed-in client is never evicted by a typo. Two failure budgets answer
429: ten per hour per account and client address, and twenty per hour
per account across all addresses. A confirmation email follows.
An account with a deletion scheduled receives the plain 403 described
on accessKeyAuth.
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”object
The password the account signs in with today.
Must differ from the current password and pass the same rules as registration, 128 characters at most.
Example generated
{ "currentPassword": "example", "newPassword": "example"}Responses
Section titled “Responses”The password was changed and the other browser sessions were signed out.
object
Browser sessions of the account that were signed out, the calling session excluded.
Example
{ "sessionsRemoved": 1}Missing fields answer a plain error. A wrong current password, a new password that fails the strength rules, or one equal to the current password answer a validation error naming the field.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
object
object
Stable machine code for this field error.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}Authentication required.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}API keys and named access keys receive a plain 403. A login session
that is not a dashboard login session receives code
dashboard_session_required.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Returned after login-session validation when a valid session that is
not a dashboard login session tries to issue or widen an API key,
create an access key or change its lifetime, enrol a passkey or
authenticator app, start a passkey step-up challenge, run the CLI
device ceremony, change the password, or request or cancel the
account’s deletion. Endpoints that enforce both guards reject API keys and
named access keys earlier with a plain 403 carrying
code: session_required. API-key creation applies only the
dashboard-session guard, so any non-dashboard credential receives
this response there. Listing,
renaming and revoking stay open to any login session. Sessions created
before the credential_origin column existed cannot be attributed to
the dashboard and are also refused; signing out and back in fixes that.
object
Example
{ "error": "This operation requires a login session. API keys and named access keys cannot access it.", "code": "session_required", "requestId": "req_abc123"}The account no longer exists.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}Too many failed requests. Two budgets apply, and either one answers
429: ten per hour per account and client address, and twenty per
hour per account across all addresses. Both are reached only after
the session guards and the pending-deletion freeze have admitted the
caller, so the 401 and the 403s above, which those produce, spend
nothing. Everything
this route answers past them spends a unit on both budgets: a wrong
current password, a new password that fails the strength rules or
equals the current one, a malformed body and a vanished account. A
successful change spends nothing. The tenant management limiter
can also answer 429, with RateLimitErrorResponse (error, retryAfterSeconds) and Retry-After, before those budgets.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Returned with HTTP 429 when an endpoint-specific rate limit is hit,
including the per-tenant management API budget. Not the process-wide
address limiter (see GlobalAddressRateLimitErrorResponse).
retryAfterSeconds
indicates how long the client should wait before retrying, and matches
the Retry-After header when that header is set. code names the
limit that fired so clients can translate without matching on error.
object
Examples
The ten-per-hour budget for this account and address
{ "error": "Too many password attempts. Please try again later.", "code": "too_many_password_attempts"}The twenty-per-hour budget for this account across all addresses
{ "error": "Too many password attempts on this account. Please try again later, or sign out every session if you did not make them.", "code": "too_many_password_attempts"}Tenant management budget spent
{ "error": "Rate limit exceeded", "code": "tenant_rate_limit_exceeded", "retryAfterSeconds": 60}Internal server error.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}