# Change Temporary Password

Changes a User's temporary password.

Endpoint: POST /change-temporary-password
Version: v1
Security: apiKeyAuth

## Security:

  - `apiKeyAuth` (unknown)
    apiKey in header x-api-key

## Header parameters:

  - `vbasoftware-client-id` (string, required)
    Client ID

  - `vbasoftware-client-code` (string, required)
    Client Code

  - `vbasoftware-database` (string, required)
    Target database

## Request fields (application/json):

  - `userID` (string, required)
    The User ID

  - `newPassword` (string, required)
    The User's new new password

  - `session` (string, required)
    The session token returned from the original login attempt that triggered the Change Temp Password flow.

## Response 200:

  - `200` (unknown)
    Success

## Response 200 fields (application/json):

  - `data` (object)

  - `data.challengeName` (string)
    The name of the challenge.  This field will be filled if the Authentication process requires additional steps.  You may programatically build application logic based on this field's value.
Valid values: NEW_PASSWORD_REQUIRED: For users who are required to change their passwords after successful first login.

  - `data.session` (string)
    The session that should pass both ways in challenge-response calls to the service. If the caller must pass another challenge, they return a session with other challenge parameters.

  - `data.authenticationResult` (object)

  - `data.authenticationResult.accessToken` (string)
    The ID token.

  - `data.authenticationResult.idToken` (string)
    The ID token.

  - `data.authenticationResult.refreshToken` (string)
    The ID token.

  - `data.authenticationResult.expiresIn` (integer)
    The expiration period of the authentication result in seconds.

  - `error` (object)

  - `error.detail` (string)
    A human-readable explanation specific to this occurrence of the problem.

  - `error.instance` (string)
    A URI reference that identifies the specific occurrence of the problem.It may
or may not yield further information if dereferenced.

  - `error.status` (integer)
    The HTTP status code([RFC7231], Section 6) generated by the origin server for
this occurrence of the problem.

  - `error.title` (string)
    A short, human-readable summary of the problem type.It SHOULD NOT change from
occurrence to occurrence of the problem, except for purposes of localization(e.g.,
using proactive content negotiation; see[RFC7231], Section 3.4).

  - `error.type` (string)
    A URI reference [RFC3986] that identifies the problem type. This specification
encourages that, when dereferenced, it provide human-readable documentation for
the problem type (e.g., using HTML [W3C.REC-html5-20141028]). When this member
is not present, its value is assumed to be "about:blank".

  - `debug` (object)

  - `debug.activityID` (string, required)

## Response 401:

  - `401` (unknown)
    Unauthorized

## Response 403:

  - `403` (unknown)
    Forbidden. The x-api-key header is missing or not valid. The API gateway sends this response, not VBAPI, so the body is not the VBAPI envelope; see Errors and troubleshooting.

## Response 429:

  - `429` (unknown)
    Too many requests. The limit is 25 requests per second sustained, with bursts up to 50, per API key. Wait and retry with exponential backoff and jitter.