# Validate password

Validates a new password according to the requesting application's password policy. The validation includes checking the password complexity (such as minimum length and character requirements) and password history (i.e., that the same password wasn't used too recently). This can be used before updating a user's password to first check that the password they chose is valid and if not, provide feedback to the user. <br><br>**Required permissions**: `apps:execute`, `[appId]:execute`, `auth:execute`.

Endpoint: POST /v1/auth/password/validate
Security: ClientAccessToken

## Request fields (application/json):

  - `email` (string)
    Email of the user who provided the password. Used to identify the user to check password history.

  - `phone_number` (string)
    Phone number of the user who provided the password. Used to identify the user to check password history.

  - `username` (string)
    Username of the user who provided the password. Used to identify the user to check password history.

  - `password` (string, required)
    Password to validate

## Response 200 fields (application/json):

  - `result` (object, required)
    Result of password validation

  - `result.valid_password` (boolean, required)
    Boolean describing if the password is valid for this app and/or user

  - `result.errors` (array, required)
    List of issues found with the given password, if validation fails

  - `result.errors.code` (string, required)
    Validation issue with given password

  - `result.errors.message` (string, required)
    Description of the specific problem with the given password

## Response 400 fields (application/json):

  - `error_code` (string)
    Enum: "system_invalid_input", "auth_password_recently_used", "auth_password_policy_disabled", "auth_not_active", "auth_password_weak", "auth_password_breached"

  - `message` (string)

## Response 404 fields (application/json):

  - `error_code` (string)
    Enum: "client_not_exist"

  - `message` (string)