Skip to main content
PUT
Change the built-in admin user's password
Rotates the built-in admin user’s password. The new password takes effect immediately — subsequent admin logins must use the new value. Call Verify admin password first to confirm the stored value in your vault is the current one before triggering this change.
For ACB deployments updated from a version prior to 1.2, switch to the https://{hostname}/EkranACB server in the Playground.

Permissions required

  • The Access Token must be issued to an Internal or Active Directory user (not an Application Account) with the administrative User Management permission.
  • The Refresh Token holder should not be the built-in admin user itself.

Password policy

The new password must meet the Syteca password policy — failing the policy returns 400 Bad Request with the specific violation in the response body. Typical requirements include minimum length, character classes, and disallowing recently-used passwords.
No rollback. Once this call returns 204, the previous password is gone — Syteca doesn’t keep the prior value. If the new password isn’t successfully written back to your secrets vault before the call completes, you can lose admin access until you can recover via the Application Server’s local fallback mechanism.Always:
  1. Generate the new password.
  2. Write it to your secrets vault first.
  3. Then call this endpoint.
If the call fails after the write, retry the call. If the call succeeds but vault write fails, you’ve created a known-bad state — recover by calling this endpoint again with the vault-stored value.

Rate limit

5 requests per minute per Access Token.

Errors

See Status codes. Common errors:
  • 400 Bad Request — new password does not meet the Syteca password policy.
  • 401 Unauthorized — invalid or expired Access Token.
  • 403 Forbidden — user lacks administrative User Management permission.

Admin password rotation

Concept page — how verify + change work together.

Verify admin password

Step 1 — confirm sync before rotating.

API reference

Authentication, status codes.

Password policy

The policy your new password must meet.

Authorizations

Authorization
string
header
required

Access token for authentication

Body

application/json
newPassword
string<password>
required

The new admin password. Must meet the Syteca password policy.

currentPassword
string<password>

The current admin password. Required if password verification is enforced; optional if not.

Response

Password changed successfully