Requires the caller's API bearer and a recent password proof from /v2/users/tokens/reauth (the web portal can also use its WEB session). The caller must own the target or have administrator/tenant authority. All credentials already present for that user are replaced atomically; no new token types are issued. Old tokens stop working immediately. Replacement WEB session secrets are returned only when rotating your own account. An account without any existing credentials cannot use this operation.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Returns user_id and a tokens object keyed by existing types (api/web). Each contains created_at and, where permitted, the new token value.
Missing recent reauthentication or insufficient authority
No credentials to rotate or replicated Admin API credential