---
title: "Step 6: Set the user password"
description: Use the PUT {{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password request to assign an initial password for the new user. The request requires the application/vnd.pingidentity.password.set+json custom content type in the Content-Type HTTP header to initate the set password action. If you're using Postman, we use a pre-request script to set the user password.
component: pingone-api
page_id: pingone-api:getting-started:create-a-test-environment/step-6-set-user-password
canonical_url: https://developer.pingidentity.com/pingone-api/getting-started/create-a-test-environment/step-6-set-user-password.html
section_ids:
  troubleshooting: Troubleshooting
  headers: Headers
  body: Body
  example-request: Example Request
  example-response: Example Response
---

# Step 6: Set the user password

##

```none
PUT {{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password
```

Use the `PUT {{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password` request to assign an initial password for the new user. The request requires the `application/vnd.pingidentity.password.set+json` custom content type in the `Content-Type` HTTP header to initate the set password action. If you're using Postman, we use a pre-request script to set the user password.

This request is an admin-level assignment of a user's initial password.

In this request:

* `{{apiPath}}` is the geographic domain for the PingOne API endpoints for your PingOne environment. The PingOne top-level domain is `https://api.pingone.com/v1` for the U.S. Refer to [PingOne API domains](../../before-you-begin/introduction.html) for the top-level domains for other regions.

* `{{envID}}` is the ID of the environment you created in the previous step. If you're using Postman, this value is automatically set by the script in the Script tab used for the previous step.

* `{{sharedUserID}}` is the ID for the user you created in the previous step. If you're using Postman, this has been automatically set for you by the script in the Script tab when you created the new user.

In the request body:

* `{{userPassword}}` is a String containing the new user password to assign. If you're using Postman, this has been automatically set for you by our pre-request script.

* `forceChange` indicates whether a user-level password change is required after a user's initial sign on. Because this is an admin-level password assignment, the `forceChange` property in the request body is set to `false`. If you like, you can set this to `true` to see the result when you first sign on as this user.

A successful response returns a `Status: 200 successful` message, and shows the user's password `status` of `OK`.

### Troubleshooting

* Verify that `{{envID}}` is the ID for the new test environment you created.

* Verify that you've assigned either the Environment Admin or Identity Admin role to your Worker app. Refer to [Assign roles to the Worker app](../create-an-admin-worker-app/step-3-assign-roles.html).

* Verify that the `{{sharedUserID}}` value is the user ID value returned by the previous step to create a user. For Postman users, unassigned variables are shown in red, and assigned variables in blue.

* Verify that the `{{userPassword}}` value in the request body is set to a valid password. For Postman users, unassigned variables are shown in red, and assigned variables in blue.

* Verify that you're using Bearer authorization for this request (and all `{{apiPath}}` requests). For Postman users, check that the Authorization tab in Postman is set to Bearer Token, and the access token variable is assigned (shown in blue, not red).

* If you get a 401 Unauthorized message, this is likely due to the access token expiring (a 1 hour expiry time). Refer to the step to get an access token, and call this request again.

* Verify that `{{apiPath}}` is correct for your geographic domain .

### Headers

Authorization      Bearer {{accessToken}}

Content-Type      application/vnd.pingidentity.password.set+json

### Body

raw ( application/vnd.pingidentity.password.set+json )

```json
{
    "value": "{{userPassword}}",
    "forceChange": false
}
```

##

### Example Request

* cURL

* C#

* Go

* HTTP

* Java

* jQuery

* NodeJS

* Python

* PHP

* Ruby

* Swift

```shell
curl --location --globoff --request PUT '{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password' \
--header 'Content-Type: application/vnd.pingidentity.password.set+json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
    "value": "{{userPassword}}",
    "forceChange": false
}'
```

```csharp
var options = new RestClientOptions("{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Put);
request.AddHeader("Content-Type", "application/vnd.pingidentity.password.set+json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@"    ""value"": ""{{userPassword}}""," + "\n" +
@"    ""forceChange"": false" + "\n" +
@"}";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
```

```golang
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password"
  method := "PUT"

  payload := strings.NewReader(`{
    "value": "{{userPassword}}",
    "forceChange": false
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/vnd.pingidentity.password.set+json")
  req.Header.Add("Authorization", "Bearer {{accessToken}}")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}
```

```http
PUT /v1/environments/{{envID}}/users/{{sharedUserID}}/password HTTP/1.1
Host: {{apiPath}}
Content-Type: application/vnd.pingidentity.password.set+json
Authorization: Bearer {{accessToken}}

{
    "value": "{{userPassword}}",
    "forceChange": false
}
```

```java
OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/vnd.pingidentity.password.set+json");
RequestBody body = RequestBody.create(mediaType, "{\n    \"value\": \"{{userPassword}}\",\n    \"forceChange\": false\n}");
Request request = new Request.Builder()
  .url("{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password")
  .method("PUT", body)
  .addHeader("Content-Type", "application/vnd.pingidentity.password.set+json")
  .addHeader("Authorization", "Bearer {{accessToken}}")
  .build();
Response response = client.newCall(request).execute();
```

```javascript
var settings = {
  "url": "{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password",
  "method": "PUT",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/vnd.pingidentity.password.set+json",
    "Authorization": "Bearer {{accessToken}}"
  },
  "data": JSON.stringify({
    "value": "{{userPassword}}",
    "forceChange": false
  }),
};

$.ajax(settings).done(function (response) {
  console.log(response);
});
```

```javascript
var request = require('request');
var options = {
  'method': 'PUT',
  'url': '{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password',
  'headers': {
    'Content-Type': 'application/vnd.pingidentity.password.set+json',
    'Authorization': 'Bearer {{accessToken}}'
  },
  body: JSON.stringify({
    "value": "{{userPassword}}",
    "forceChange": false
  })

};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});
```

```python
import requests
import json

url = "{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password"

payload = json.dumps({
  "value": "{{userPassword}}",
  "forceChange": False
})
headers = {
  'Content-Type': 'application/vnd.pingidentity.password.set+json',
  'Authorization': 'Bearer {{accessToken}}'
}

response = requests.request("PUT", url, headers=headers, data=payload)

print(response.text)
```

```php
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password');
$request->setMethod(HTTP_Request2::METHOD_PUT);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/vnd.pingidentity.password.set+json',
  'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n    "value": "{{userPassword}}",\n    "forceChange": false\n}');
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}
```

```ruby
require "uri"
require "json"
require "net/http"

url = URI("{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Put.new(url)
request["Content-Type"] = "application/vnd.pingidentity.password.set+json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
  "value": "{{userPassword}}",
  "forceChange": false
})

response = http.request(request)
puts response.read_body
```

```swift
let parameters = "{\n    \"value\": \"{{userPassword}}\",\n    \"forceChange\": false\n}"
let postData = parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{apiPath}}/v1/environments/{{envID}}/users/{{sharedUserID}}/password")!,timeoutInterval: Double.infinity)
request.addValue("application/vnd.pingidentity.password.set+json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")

request.httpMethod = "PUT"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()
```

### Example Response

200 OK

```json
{
    "_links": {
        "self": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/users/b7119e13-9612-42d0-a57c-039e74a0f27c/password"
        },
        "environment": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
        },
        "user": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/users/b7119e13-9612-42d0-a57c-039e74a0f27c"
        },
        "passwordPolicy": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/passwordPolicies/a6f57fd8-0597-448c-8993-8bec226c38ef"
        },
        "password.check": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/users/b7119e13-9612-42d0-a57c-039e74a0f27c/password"
        },
        "password.reset": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/users/b7119e13-9612-42d0-a57c-039e74a0f27c/password"
        },
        "password.set": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/users/b7119e13-9612-42d0-a57c-039e74a0f27c/password"
        },
        "password.recover": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/users/b7119e13-9612-42d0-a57c-039e74a0f27c/password"
        }
    },
    "environment": {
        "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
    },
    "user": {
        "id": "b7119e13-9612-42d0-a57c-039e74a0f27c"
    },
    "passwordPolicy": {
        "id": "a6f57fd8-0597-448c-8993-8bec226c38ef"
    },
    "status": "OK",
    "lastChangedAt": "2026-03-23T16:40:01.366Z"
}
```