Change User Password (Without OTP)

Change User Password (Without OTP)

This endpoint allows a partner to change a customer's password without requiring a One-Time Password (OTP) confirmation from Netevia. The new password must be provided in Base64 encoded format before sending the request. Partners are responsible for implementing their own additional security controls — such as internal identity verification, MFA, or approval workflows — before initiating the password change.

Endpoint

POST /api/Partners/users/changePassword

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when your platform manages its own security validation workflows and does not require Netevia's OTP-based confirmation step. This is suitable for partners who have implemented multi-factor authentication, internal identity verification, or formal approval processes on their side. It provides flexibility for partners who need programmatic, automated, or admin-driven password resets without end-user OTP interaction.

Request Body

{
  "userId": 1048293,
  "password": "TmV3UGFzc3dvcmQxMjMh"
}

Response

200 OK

A 200 status indicates the password was successfully updated. No response body fields are returned.

{}

Error Codes

Common Mistakes

• Sending the password as plain text instead of Base64 encoded — the password field must always be Base64 encoded before sending.
• Using a string value for userId instead of an integer — the field type is int32, not a string.
• Omitting either userId or password — both fields are required and the request will fail with a 400 if either is missing.
• Initiating a password change without completing partner-side security validation first — this endpoint bypasses Netevia's OTP flow, so your platform must enforce its own security controls before calling it.

Related Endpoints

• POST /api/auth/v2 — Obtain a Bearer token for authentication
• POST /api/auth/refresh — Refresh an expired Bearer token

Example

curl -X POST https://api.banking.netevia.dev/api/Partners/users/changePassword \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": 1048293,
    "password": "TmV3UGFzc3dvcmQxMjMh"
  }'