> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify Admin Password

> Syteca ACB REST API endpoint to verify the current built-in admin password matches the value the caller expects — used before triggering a rotation to confirm vault/Syteca sync.

Verifies the current built-in `admin` password matches a value the caller provides. The canonical "pre-flight check" for an automated rotation workflow — call this **before** [Change admin password](/docs/api/acb/endpoints/change-admin-password) to confirm the value in your secrets vault is still the current one. Catches desync between vault and Syteca before you replace a value that's already been changed elsewhere.

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

* The Access Token must be issued to an **Internal or Active Directory user** (not an Application Account) with the [administrative User Management permission](/docs/administration/users/administrative-permissions).
* The Refresh Token holder should not be the built-in `admin` user itself — see [Admin password rotation → Prerequisites](/docs/api/acb/admin-password-rotation#prerequisites).

### What the response means

The response has a single boolean `verified` field:

| Value   | Meaning                                                                                                                                                                                                 |
| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `true`  | The provided password matches the current admin password. Safe to proceed with rotation.                                                                                                                |
| `false` | The provided password does **not** match. **Don't rotate** — investigate desync first (someone may have rotated the admin password through the Management Tool UI without updating your secrets vault). |

<Warning>
  **A `false` response is an alert condition.** Either your vault is out of sync, or the admin password was rotated by someone else. Investigate before calling [Change admin password](/docs/api/acb/endpoints/change-admin-password) — overwriting an unknown-current value can lock administrative access if your rotation fails partway through.
</Warning>

### Rate limit

**5 requests per minute per Access Token.** Intentionally bandwidth-limited to make brute-force attacks impractical.

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **401 Unauthorized** — invalid or expired Access Token.
* **403 Forbidden** — user lacks administrative User Management permission.
* **429 Too Many Requests** — rate limit exceeded.

## Related

<CardGroup cols={2}>
  <Card title="Admin password rotation" icon="key-square" href="/docs/api/acb/admin-password-rotation">Concept page — how verify + change work together.</Card>
  <Card title="Change admin password" icon="refresh-ccw" href="/docs/api/acb/endpoints/change-admin-password">Step 2 — actually rotate.</Card>
  <Card title="API reference" icon="square-code" href="/docs/api/acb/api-reference">Authentication, status codes.</Card>
  <Card title="Administrative permissions" icon="key" href="/docs/administration/users/administrative-permissions">User Management permission details.</Card>
</CardGroup>


## OpenAPI

````yaml POST /api/auth/verify
openapi: 3.0.1
info:
  title: Application Credentials Broker API
  description: API for managing users in the Application Credentials Broker system
  version: 1.0.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/auth/verify:
    post:
      tags:
        - Admin Password Rotation
      summary: Verify the current admin password
      description: >-
        Verifies the current built-in admin password is what the caller expects.
        Used by external secrets vaults before triggering a rotation to confirm
        the stored value is still correct.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyAdminPasswordRequest'
      responses:
        '200':
          description: Verification completed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyAdminPasswordResponse'
        '401':
          description: Invalid or expired Access Token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: User lacks administrative User Management permission
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - AccessTokenAuth: []
components:
  schemas:
    VerifyAdminPasswordRequest:
      type: object
      required:
        - password
      properties:
        password:
          type: string
          format: password
          description: The current admin password to verify.
    VerifyAdminPasswordResponse:
      type: object
      properties:
        verified:
          type: boolean
          description: Whether the provided password matches the current admin password.
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````