Changes the account password after verifying the current one, and returns freshly minted nonces so the open session keeps working.
All three of current_password, new_password and confirm_password are required; the new password must be at least four characters, must match the confirmation and must differ from the current one. Because WordPress destroys every session on a password change, the endpoint re-issues the auth cookie and returns new rest_nonce and ajax_nonce values — the client must adopt them or every subsequent request will fail.
Endpoint
Method:
POSTPath:
/profile/{username}/change-passwordEdition: Core
Controller:
ProfileController@changePasswordRoute source:
fluent-community/app/Http/Routes/api.php:89Controller source:
fluent-community/app/Http/Controllers/ProfileController.phpOnly the account owner can call this; moderators and admins cannot change a password here.
Blocked entirely when the
can_change_passwordprivacy setting is off.Every other session for the account is logged out.
Live sample
The request and response below were recorded against a running FluentCommunity install and then anonymised — member names, emails, avatars and post content are fictional, and long collections are trimmed to a few entries.
POST Post Change Password
Changes the account password after verifying the current one, and returns freshly minted nonces so the open session keeps working.
Controller: ProfileController@changePassword
Route source: fluent-community/app/Http/Routes/api.php:89
Authorizations
WordPress Application Passwords — use Basic auth with username:application_password.
Parameters
Path Parameters
Username extracted from the URL path.
Request Body
Responses
Successful response