The appropriate call to update a user's password by providing a new one is:
PUT /d2l/api/lp/(version)/users/( userId)/password {
"Password": <new password string>
}
Some notes:
- Note that the call does not accept a trailing slash, and it is also a PUT route.
- Note that the POST route enforces a password reset on the user by sending them the "reset password email". It also does not accept a trailing slash; nor does it accept any body data in the POST body (it's an empty post, that should have Content-Length: 0): POST /d2l/api/lp/(version)/users/( userId)/password
- Note that all these methods will likely constitute a "password change event" and will result in having the LMS flush out all the Valence user ID/key tokens for that user, for all Valence applications.
- If that user is using any Valence apps, they will likely be prompted to re-authenticate to get new tokens for each application. This is a security feature that's not avoidable, and can have significant impact if, for example, you're changing the password to drive a "service user-account for an administrative Valence app" that lets the app or script do administrative tasks in a "headless" manner.
Required Permissions?
Tool Permission OU Type UserInfoPrivacy See Org Defined IDs Organization Users View the users' email address Organization Users View users' defined ids Organization Users View user enrollments Organization Users See the user management tool Organization Users View users' contact information Organization Users Update a user Organization Users Send the users' password by email Organization Users Reset the users' passwords in the edit tool Organization Users See User Preferred Locales Organization