Change this mailbox's password

POST/api/v1/mailbox/security/password
Requires amailbox token— it acts as one mailbox holder, not as the organization.

Verifies current_password by IMAP LOGIN against Dovecot (the same check sign-in uses), enforces the platform password policy on new_password, stores the new bcrypt hash, flushes Dovecot's auth cache so IMAP/SMTP honour the change immediately, and signs out every OTHER session of this mailbox. The calling session stays signed in. Clears a pending forced change (must_change_password), so this is the one route a session carrying a temporary password may call besides sign-out. Failed current_password attempts count against the same lockout as sign-in.

Request body

Request

POST/api/v1/mailbox/security/password
curl -X POST 'https://app.mailyte.com/api/v1/mailbox/security/password' \
  -H 'Authorization: Bearer MAILBOX_TOKEN'
The key names its own organization, so no X-Organization-ID header is needed.

Response

Successful Response

Returned inside the standard envelope.

Errors

StatusWhen
401`error_code: wrong_password` -- Dovecot refused current_password
409`error_code: password_reused` -- new password equals the current
422`error_code: weak_password` -- `msg` carries the failed rule
429Too many failed attempts (shared with sign-in lockout)
502Dovecot unreachable -- the password was not checked

Every status, with what causes it and what to do, is on the error reference.