# Updates a user's password reset flag for account security management

`PUT /api/users/{username}/reset-password-flag`

- **Products:** Operator (`FOH`)
- **Features:** Front of House Generic Access (`FOHGENERIC`)

HTML version: [Updates a user's password reset flag for account security management](https://support.gladstonesoftware.cloud/reference/users/updates-a-users-password-reset-flag-for-account-security-management)

## Overview

Sets or clears the flag that forces a staff (back-office) user to choose a new password at their next sign-in. Returns `204 No Content` with no body. It does not change the password itself and does not notify the user — pair it with [Updates the password for a specific user account](updates-the-password-for-a-specific-user-account.md) when you are issuing a temporary password, and tell the user out of band.

The usual sequence for handing an account back to its owner is: set a temporary password, then set this flag to `true`. On [ObjectId-role tenants](retrieves-all-administrative-users-configured-in-the-system.md) a successful password change clears the flag automatically, so setting it before you set the password would undo your own work — set the password first.

Setting the flag to `false` is the way out of a reset loop, where a user is asked to change their password every time they sign in because the flag was never cleared.

The flag is written to the same place `isPasswordResetFlagSet` on [Updates the details and settings for a specific administrative user](updates-the-details-and-settings-for-a-specific-administrative-user.md) writes to, and reads back through `isPasswordResetFlagSet` on the user-retrieval endpoints. This endpoint is the narrower of the two: it touches only the flag, where the update endpoint replaces the whole account record.

## Endpoint

`PUT {base_url}/api/users/{username}/reset-password-flag`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `username` | string | Yes | The sign-in name of the account whose flag is being changed, as returned in `[].username` by [Retrieves all administrative users configured in the system](retrieves-all-administrative-users-configured-in-the-system.md). Matched exactly. The account must have a legacy system-user record as well as its main user account, or the call fails with `404` even though the user is otherwise usable. |

## Request body

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `resetPasswordFlag` | boolean | No | `true` forces the user to set a new password the next time they sign in; `false` clears that requirement. Because the field is a non-nullable boolean, omitting it or sending `null` is not "leave as is" — it reads as `false` and clears any pending forced reset. Always send the value you want explicitly. Read the current setting from `isPasswordResetFlagSet` on [Retrieves detailed information for a specific administrative user](retrieves-detailed-information-for-a-specific-administrative-user.md). |

## Sample request

```bash title="cURL"
curl -X PUT '{base_url}/api/users/{username}/reset-password-flag' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true' \
  -H 'Content-Type: application/json' \
  -d '{
  "resetPasswordFlag": true
}'
```

## Errors

| Status | Meaning | When |
|--------|---------|------|
| `404` | Not found | No account exists with that username, or the account has no legacy system-user record, which is what holds the flag: `The user with the username: {username} could not be found`. On ObjectId-role tenants the account must be fully set up, and the message is `The user with username: {username} could not be found`. |
| `500` | Internal server error | Any other unexpected server-side failure — for example the tenant's authentication configuration being missing or invalid, or the change failing to save completely. Returned with no body. |