Appearance
Directly set a user's password (admin only)
POST
/users/{userId}/set_password
Sets the password for a user account without requiring the old password. Requires admin role. The password must meet the configured minimum length (default 15 characters). Does not send any email notification. Used for urgent password resets when SMTP is unavailable.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "user": { "password": "SecureP@ssw0rd2026!" }
{
}
Responses
Password updated
application/json
JSON "toast": { "title": "Password updated.", "message": [ "Password updated for jane.doe@example.org." ], "variant": "success" }
{
}