# Is there any endpoint that checks if I can use the new password before updating the user's password?

**URL:** <https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957>\
**Category:** Get Help\
**Tags:** users, management-api\
**Created:** [September 22, 2023, 7:13pm UTC](https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957 "2023-09-22T19:13:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![omar.camacho](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@omar.camacho](https://community.auth0.com/u/omar.camacho)\
**Post date:** [September 22, 2023, 7:13pm UTC](https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957/1 "2023-09-22T19:13:01Z")

</div>

Hi everyone, I am using the following flow to change or reset the password [https://auth0.com/docs/authenticate/database-connections/password-change#directly-set-the-new-password,](https://auth0.com/docs/authenticate/database-connections/password-change#directly-set-the-new-password) I also have the Password History option enabled.

However, before updating the password, I would like to check if the new password can be used or not (depending on the Password History) without updating the user’s password, so my question is, is there any endpoint in the Management API or Authentication API that checks if I can use the password? or the only way is when I call the endpoint to update the user password (described in this link [https://auth0.com/docs/authenticate/database-connections/password-change#directly-set-the-new-password,](https://auth0.com/docs/authenticate/database-connections/password-change#directly-set-the-new-password)?

Thank you,

---

<div class="post-metadata">

**Author:** ![gparascandolo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gparascandolo/32/38788_2.png) [@gparascandolo](https://community.auth0.com/u/gparascandolo)\
**Post date:** [September 22, 2023, 7:49pm UTC](https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957/2 "2023-09-22T19:49:56Z")

</div>

Hi @omar.camacho 👋

If you have the Password History option enabled in your database connection, you don’t need to check if you can use the new password before making the Management API request.

You will receive a 400 response from Auth0 if the password you are trying to use already exists in the user’s password history.

For example, the API response will look something like:

```auto
{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "PasswordHistoryError: Password has previously been used"
}

```

You can test out the Management API endpoint here: [Auth0 Management API v2](https://auth0.com/docs/api/management/v2/users/patch-users-by-id)

Hope this helps!

---

<div class="post-metadata">

**Author:** ![omar.camacho](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@omar.camacho](https://community.auth0.com/u/omar.camacho)\
**Post date:** [September 22, 2023, 9:02pm UTC](https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957/3 "2023-09-22T21:02:16Z")

</div>

Thanks a lot for your help @gparascandolo,

I understand that this endpoint validates and updates the user’s password. The implementation I must do is first validate whether I can use the password before the call to update the user’s password, this is at the request of the client I work with.

I really appreciate your help!

---

<div class="post-metadata">

**Author:** ![omar.camacho](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@omar.camacho](https://community.auth0.com/u/omar.camacho)\
**Post date:** [September 25, 2023, 8:04pm UTC](https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957/4 "2023-09-25T20:04:16Z")

</div>

Hi @gparascandolo,

As I mentioned before, the implementation I must do is first validate whether I can use the password before calling the endpoint to update the user’s password, this is at the request of the client I work with, so could you please help me by indicating if there is any endpoint in the Management API or Authentication API that checks if I can use the new password?

Thanks a lot again, I really appreciate your help!

---

<div class="post-metadata">

**Author:** ![gparascandolo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gparascandolo/32/38788_2.png) [@gparascandolo](https://community.auth0.com/u/gparascandolo)\
**Post date:** [September 26, 2023, 3:26pm UTC](https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957/5 "2023-09-26T15:26:22Z")

</div>

Hi @omar.camacho, hopefully someone from Auth0 can come and confirm, but I don’t believe there is an API endpoint like this. I suspect this is for security reasons.

You can put in a feature request in this forum to ask Auth0 to add this functionality for your needs 🙏

---

<div class="post-metadata">

**Author:** ![omar.camacho](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@omar.camacho](https://community.auth0.com/u/omar.camacho)\
**Post date:** [September 26, 2023, 4:42pm UTC](https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957/6 "2023-09-26T16:42:26Z")

</div>

Thanks a lot for your help @gparascandolo, I will see how to change the flow to use only the endpoint to update the user’s password that they offer.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 10, 2023, 4:42pm UTC](https://community.auth0.com/t/is-there-any-endpoint-that-checks-if-i-can-use-the-new-password-before-updating-the-users-password/116957/7 "2023-10-10T16:42:28Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.