Back to API Practice

Security/Auth trainer

Change Password API Practice

Practice old password validation, password policy, confirmation mismatch, session invalidation, safe password handling, outages, and audit trails.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated POST /api/auth/change-password request, inspect the fake response, and turn it into test ideas.

No real password is sent. This is a client-side simulator with placeholder values.

Request

Build the request

POST/api/auth/change-password

Request JSON

application/json
{
  "currentPassword": "OldPassword123!",
  "newPassword": "NewPassword456!",
  "confirmPassword": "NewPassword456!",
  "revokeOtherSessions": true
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Validation

Password policy

Auth

Reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List valid change, wrong old password, missing fields, weak/reused new password, confirmation mismatch, new password works, old password rejected, session invalidation, rate limits, safe logs, outages, and audit events.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Change Password endpoint

Change an authenticated user's password with old-password verification, policy validation, session handling, safe storage, and auditability.

Endpoint

POST/api/auth/change-password

Purpose

Change an authenticated user's password with old-password verification, policy validation, session handling, safe storage, and auditability.

Request fields

  • currentPassword: old password, required
  • newPassword: replacement password, required
  • confirmPassword: confirmation field if used
  • revokeOtherSessions: optional boolean

Success response

204 No Content

Request body

{
  "currentPassword": "OldPassword123!",
  "newPassword": "NewPassword456!",
  "confirmPassword": "NewPassword456!"
}

Example response body

{
  "status": "changed",
  "sessionsRevoked": true
}

Errors

  • 400 validation error
  • 401 missing/expired session
  • 403 wrong old password
  • 409 reused password
  • 422 weak/breached password
  • 429 rate limited
  • 503 auth provider unavailable

Security notes

  • Passwords are hashed and never returned
  • No password values in logs or analytics
  • Repeated old-password failures are rate limited
  • Password change events are audited

Business rules

  • Old password is verified before update
  • Password policy matches signup/reset policy
  • Old password is rejected after change
  • Session/token invalidation follows product rules
  • Password update is atomic