> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Change Admin Password

> Syteca ACB REST API endpoint to rotate the built-in admin user's password — for automated rotation from external secrets vaults, CMDB, or compliance workflows.

Rotates the built-in `admin` user's password. The new password takes effect **immediately** — subsequent admin logins must use the new value. **Call [Verify admin password](/docs/api/acb/endpoints/verify-password) first** to confirm the stored value in your vault is the current one before triggering this change.

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

* The Access Token must be issued to an **Internal or Active Directory user** (not an Application Account) with the [administrative User Management permission](/docs/administration/users/administrative-permissions).
* The Refresh Token holder should not be the built-in `admin` user itself.

### Password policy

The new password must meet the Syteca [password policy](/docs/pam/secrets/configure-password-management) — failing the policy returns **400 Bad Request** with the specific violation in the response body. Typical requirements include minimum length, character classes, and disallowing recently-used passwords.

<Warning>
  **No rollback.** Once this call returns 204, the previous password is gone — Syteca doesn't keep the prior value. If the new password isn't successfully written back to your secrets vault before the call completes, you can lose admin access until you can recover via the Application Server's local fallback mechanism.

  **Always**:

  1. Generate the new password.
  2. Write it to your secrets vault first.
  3. Then call this endpoint.

  If the call fails after the write, retry the call. If the call succeeds but vault write fails, you've created a known-bad state — recover by calling this endpoint again with the vault-stored value.
</Warning>

### Rate limit

**5 requests per minute per Access Token.**

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **400 Bad Request** — new password does not meet the Syteca password policy.
* **401 Unauthorized** — invalid or expired Access Token.
* **403 Forbidden** — user lacks administrative User Management permission.

## Related

<CardGroup cols={2}>
  <Card title="Admin password rotation" icon="key-square" href="/docs/api/acb/admin-password-rotation">Concept page — how verify + change work together.</Card>
  <Card title="Verify admin password" icon="check" href="/docs/api/acb/endpoints/verify-password">Step 1 — confirm sync before rotating.</Card>
  <Card title="API reference" icon="square-code" href="/docs/api/acb/api-reference">Authentication, status codes.</Card>
  <Card title="Password policy" icon="lock" href="/docs/pam/secrets/configure-password-management">The policy your new password must meet.</Card>
</CardGroup>


## OpenAPI

````yaml PUT /api/users/admin/password
openapi: 3.0.1
info:
  title: Application Credentials Broker API
  description: API for managing users in the Application Credentials Broker system
  version: 1.0.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/users/admin/password:
    put:
      tags:
        - Admin Password Rotation
      summary: Change the built-in admin user's password
      description: >-
        Rotates the built-in admin user's password. The new password takes
        effect immediately — subsequent admin logins must use the new value.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChangeAdminPasswordRequest'
      responses:
        '204':
          description: Password changed successfully
        '400':
          description: New password does not meet the Syteca password policy
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Invalid or expired Access Token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: User lacks administrative User Management permission
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - AccessTokenAuth: []
components:
  schemas:
    ChangeAdminPasswordRequest:
      type: object
      required:
        - newPassword
      properties:
        currentPassword:
          type: string
          format: password
          description: >-
            The current admin password. Required if password verification is
            enforced; optional if not.
        newPassword:
          type: string
          format: password
          description: The new admin password. Must meet the Syteca password policy.
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````