> ## Documentation Index > Fetch the complete documentation index at: https://docs.nvisy.com/llms.txt > Use this file to discover all available pages before exploring further. # Set or change password > Sets or changes the account's password. Changing an existing password requires the current password; setting a first password on an account that has none requires a step-up re-authentication proof. ## OpenAPI ````yaml /api-reference/openapi.json put /account/identities/password openapi: 3.1.0 info: title: Nvisy API summary: Document detection and redaction platform description: >- Nvisy provides intelligent detection of sensitive content in documents, redaction pipelines, and reviewer workflows. This API enables document upload, detection analysis, redaction, and collaborative review across your workspaces. termsOfService: https://nvisy.com/legal/terms-of-service contact: name: Nvisy Support url: https://nvisy.com email: hello@nvisy.com license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 version: 0.1.0 servers: [] security: [] tags: - name: Health description: Service health checks - name: Capabilities description: Read-only reference data describing this deployment - name: Accounts description: Account management and profile operations - name: Identities description: 'Account sign-in methods: password and linked providers' - name: Avatars description: Public avatar image serving - name: Authentication description: Login, signup, and token management - name: Workspaces description: Workspace creation and management - name: Activities description: Workspace activity log and export - name: Documents description: Document upload, download, and management - name: Analytics description: Aggregate metrics over a workspace's documents - name: Members description: Workspace member management - name: Invites description: Workspace invitation handling - name: API Tokens description: API token management - name: Connections description: External provider connections - name: Connection Syncs description: Connection synchronization runs - name: Providers description: Inference-provider configuration - name: Pipelines description: Redaction pipeline configuration - name: Detections description: Detection analysis and redaction - name: Redactions description: Redactions produced from a detection, with reviewer edits - name: Reviews description: Document reviews, the review queue, and their discussion - name: Policies description: Redaction policy configuration - name: Webhooks description: Webhook configuration - name: Notifications description: Account notification management paths: /account/identities/password: put: tags: - Identities summary: Set or change password description: >- Sets or changes the account's password. Changing an existing password requires the current password; setting a first password on an account that has none requires a step-up re-authentication proof. requestBody: description: >- A password set or change. When the account already has a password, `current_password` is required and verified before the change is applied, so a hijacked session or CSRF cannot silently reset it (and lock out the real owner). When the account has no password yet (an SSO-only account setting its first one), there is nothing to re-authenticate against, so a fresh step-up `reauth_proof` is required instead — a live session alone must not mint a durable new credential. content: application/json: schema: $ref: '#/components/schemas/SetPassword' required: true responses: '204': description: Password set. '400': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '415': description: 'Expected request with `Content-Type: application/json`' content: text/plain: schema: type: string '422': description: Failed to deserialize the JSON body into the target type content: text/plain: schema: type: string security: - BearerAuth: [] components: schemas: SetPassword: description: >- A password set or change. When the account already has a password, `current_password` is required and verified before the change is applied, so a hijacked session or CSRF cannot silently reset it (and lock out the real owner). When the account has no password yet (an SSO-only account setting its first one), there is nothing to re-authenticate against, so a fresh step-up `reauth_proof` is required instead — a live session alone must not mint a durable new credential. type: object properties: currentPassword: description: >- The account's current password. Required when the account already has a password; omitted when setting a first password on an account that has none (supply `reauth_proof` instead). type: string newPassword: description: The new password (will be hashed before storage). type: string maxLength: 128 minLength: 8 reauthProof: description: >- A step-up re-authentication proof (from the OIDC reauth endpoint). Required when *setting a first password* on an account that has none; ignored when changing an existing password. type: string required: - newPassword ErrorResponse: description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error type: object properties: message: description: User-friendly error message safe for client display. type: string name: description: The error name/type identifier. type: string required: - name - message ````