User Passwords

When: A password operation targets a user whose lifecycle.status is INVITED, an administrative PUT Update Password (Self or Admin) or POST Password Check, Recover, or Send (Resend) Recovery Code request targets a self‑service user with an authoritative identity provider, or a POST Password Recover request runs after five failed recovery attempts with the given code

Details: Operation not allowed for users with lifecycle.status INVITED, Operation not allowed for users with an authoritative identity provider., or Maximum password recovery failures exceeded. Initiating another password recovery process resets the failure count.

When: A POST Send (Resend) Recovery Code request targets a user without an email address, or the account is locked for reasons other than a locked password

Details: The user does not have an email address or Account is locked out with a secondsUntilUnlock inner error when the unlock time is known.

When: A password check, unlock, force change, or Send (Resend) Recovery Code request targets a disabled user

Details: The user is disabled

When: A POST Password Check or self-change PUT Update Password request runs while the password is locked out, or the failed attempts in the request lock the password out

Details: Account is locked out or The password is temporarily or administratively locked out, with a secondsUntilUnlock inner error when the unlock time is known.

When: A POST Password Check request targets a user without a provisioned password, or with an expired password, or a self-change PUT Update Password request runs before the minimum password age has elapsed, or the password check timed out

Details: The user does not have a password set, The user’s password is expired (target password), The password cannot be changed because it has not been long enough since the last password change, or A timeout was encountered when checking the password.

When: A POST Password Check or self-change PUT Update Password request provides a password that does not match the provisioned password, a self-change request provides an incorrect currentPassword, a set or update request provides a newPassword or value that does not satisfy the password policy, or a POST Password Recover request provides an invalid or expired recoveryCode

Details: The provided password did not match provisioned password (target password) or The current password provided for the user is invalid (target currentPassword), each with a failuresRemaining inner error when the warning is present; New password did not satisfy password policy requirements (target newPassword or value) with the failed checks in the unsatisfiedRequirements inner error; or The provided password recovery code was invalid or expired (target recoveryCode)

When: A POST Password Check request omits password, a POST Password Recover request omits recoveryCode or newPassword, a PUT Update Password (Self or Admin) request omits newPassword, or a PUT Update Password (Set) request omits value

Details: must not be empty with target = the omitted field

When: A POST Password Check, PUT Update Password (Self or Admin), or Set request provides a password, newPassword, or value longer than 256 characters

Details: size must be between 0 and 256 with target = the offending field and rangeMinimumValue 0 and rangeMaximumValue 256 inner errors

When: A PUT Update Password (Self or Admin) or POST Password Recover request provides a pre-encoded password (a password that starts with a storage-scheme prefix such as {SSHA})

Details: The password must not be pre-encoded. with no target

When: A PUT Update Password (Self or Admin) or Update Password (Set) request provides a pre-encoded {PBKDF2} password that fails validation, such as too many iterations

Details: Invalid PBKDF2 password., PBKDF2 password must start with {PBKDF2}., PBKDF2 password must be at least 13 bytes long after the {PBKDF2} prefix. Provided: <length>., PBKDF2 version must be 0x00, 0x01, 0x02, or 0x03. Provided: 0x<version>., PBKDF2 salt length must be between 8 and 127 bytes. Provided: <saltLength>., or PBKDF2 iterations must not be greater than 5000000. Provided: <iterations>

When: A request body cannot be deserialized as JSON, or the LDAP gateway in password.external.gateway does not allow password changes for the user type

Details: For a JSON field conversion error, the detail is Invalid value for attribute. with target = the field path. For a gateway that disallows password changes, the message is A system error occurred when accessing your account for authentication. Contact your administrator. with no detail.

When: A PUT Update Password (External) request references a gateway or user type that does not exist, or a gateway that is not an LDAP gateway

Details: Gateway does not exist. or UserType does not exist in gateway. with detail code INVALID_VALUE, or Only LDAP gateway type is supported. with detail code CONSTRAINT_VIOLATION

When: The actor lacks the permission required by the operation (dir:read:userPassword for Read Password State, dir:validate:userPassword for Password Check, dir:forceChange:userPassword for Force Change Password, dir:recover:userPassword for Send (Resend) Recovery Code and Password Recover, dir:unlock:userPassword for Unlock User Password, or dir:reset:userPassword for Update Password Self/Admin, dir:set:userPassword for Update Password Set, Set Value, and External), is not authorized for the target user’s population or group scope, or attempts a self-service administrative action (dir:forceChange:userPassword, dir:reset:userPassword, or dir:set:userPassword operations) on their own account

Details: None.

When: The user ID or environment ID in the request URL does not exist

Details: None.

When: A Send (Resend) Recovery Code request exceeds the password recovery rate limit for the user’s email address

Details: None.