> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Record a completed self-service password change > Record a completed password change for the authenticated user and send them the matching security alert — an in-app notification, a security email, and a mobile push. Call this after a self-service password change succeeds so the user is notified that their credentials were updated. Only the authenticated caller is ever notified, so the endpoint cannot raise an alert on another account. The request body is optional and ignored; the response returns `ok` and the `changed_at` timestamp of the recorded change. ## OpenAPI ````yaml /openapi.yaml post /api/v1/settings/security/password-changed openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway paths: /api/v1/settings/security/password-changed: post: tags: - Settings summary: Record a completed self-service password change description: >- Record a completed password change for the authenticated user and send them the matching security alert — an in-app notification, a security email, and a mobile push. Call this after a self-service password change succeeds so the user is notified that their credentials were updated. Only the authenticated caller is ever notified, so the endpoint cannot raise an alert on another account. The request body is optional and ignored; the response returns `ok` and the `changed_at` timestamp of the recorded change. requestBody: required: false content: application/json: schema: type: object description: No body is required. Any supplied fields are ignored. responses: '200': description: >- The password change was recorded and the security alert was queued for delivery. content: application/json: schema: type: object properties: data: type: object required: - ok - changed_at properties: ok: type: boolean description: Always true once the change has been recorded. changed_at: type: string format: date-time description: >- ISO-8601 timestamp of when the password rotation was recorded. meta: $ref: '#/components/schemas/ResponseMeta' '401': $ref: '#/components/responses/StandardError' components: schemas: ResponseMeta: type: object required: - request_id - timestamp additionalProperties: false properties: request_id: type: string description: Unique request identifier (also returned as X-Request-Id header) timestamp: type: string format: date-time docs_url: type: string format: uri nullable: true responses: StandardError: description: >- Standard error envelope. `error.code` is machine-readable; see the [error reference](https://docs.orbit.devotel.io/reference/error-codes) for the catalogue. content: application/json: schema: type: object properties: error: type: object required: - code - message - status properties: code: type: string description: Machine-readable error code (e.g. INVALID_PHONE_NUMBER) message: type: string description: Human-readable error description status: type: integer description: HTTP status code details: type: object additionalProperties: true description: Additional context about the error meta: type: object properties: request_id: type: string timestamp: type: string format: date-time docs_url: type: string format: uri description: Link to relevant error documentation securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````