/patron/{patronId}/credential/change Change the patron's own password or pin code.
Change a credential the patron already knows.
The credential field says which credential is being changed, and the current and new values are named after it, so a password and a pin code can never be sent in each other's place. It must be one of the credentials in patron->credentials->changeable in the configuration, otherwise the provider returns the error code 100013.
The provider must verify the current credential before applying the new one, and returns the error code 100001 if it is wrong. This is the only proof in the request that the caller is the patron, since the bearer token identifies the vendor and patronId is just an identifier.
PLAS states no format for a password or a pin code. If the provider rejects the new value it returns the error code 100011, and the info should say what was wrong, since there is nothing in the configuration for the vendor to validate against beforehand.
The endpoint is also a way to guess the current credential, so the provider is expected to rate limit it per patron, and should answer 429 rather than 400 once the limit is reached. This matters most for a pin code, which is short enough to be guessed outright if nothing throttles the attempts.
A patron who does not know their current credential uses POST /patron/credential/reset instead.
Example request
cURL
curl -X POST "$PLAS_BASE_URL/patron/40218873/credential/change?version=0.6.7" \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer $PLAS_TOKEN" \
-d '{
"credential": "password",
"currentPassword": "correct-horse-battery",
"newPassword": "lantern-river-staple"
}'JavaScript
const response = await fetch(`${process.env.PLAS_BASE_URL}/patron/40218873/credential/change?version=0.6.7`, {
method: "POST",
headers: {
"Accept": "application/json",
"Content-Type": "application/json",
"Authorization": `Bearer ${process.env.PLAS_TOKEN}`,
},
body: JSON.stringify({
"credential": "password",
"currentPassword": "correct-horse-battery",
"newPassword": "lantern-river-staple"
}),
});Python
import os
import requests
response = requests.post(
f"{os.environ['PLAS_BASE_URL']}/patron/40218873/credential/change",
params={
"version": "0.6.7",
},
headers={
"Accept": "application/json",
"Content-Type": "application/json",
"Authorization": f"Bearer {os.environ['PLAS_TOKEN']}",
},
json={
"credential": "password",
"currentPassword": "correct-horse-battery",
"newPassword": "lantern-river-staple",
},
)
response.raise_for_status()PLAS_BASE_URL the provider’s base URL · PLAS_TOKEN an access token.
Parameters
- patronIdrequired
- path · stringExample: 40218873
Patron ID from authentication.
Request body
application/json · required · ChangePatronCredentialRequestBody Selected by the field credential
Variant: password
ChangePatronPasswordRequestBody
- credentialstringrequired
One of: password
- currentPasswordstringrequired
The patron's current password.
The provider must verify this before applying
newPassword. It is the only proof in the request that the caller is the patron, and not someone who knows the patron ID. - newPasswordstringrequired
The password the patron wants from now on.
Variant: pin
- credentialstringrequired
One of: pin
- currentPinstringrequired
The patron's current pin code.
The provider must verify this before applying
newPin. It is the only proof in the request that the caller is the patron, and not someone who knows the patron ID. - newPinstringrequired
The pin code the patron wants from now on.
Responses
204 The credential was changed, and the current value no longer works.
No response body.
400 The list of errors. Errors
Shared response, defined once for the whole API. See the shared contract on the version page.
Example
{
"errors": [
{
"code": 200103,
"info": "200103: invalid/unsupported query parameter value"
}
]
}Schema
The first error should always be the most relevant.
Show 2 fieldsHide 2 fields
- codeintegerrequired
A number representing the type of error.
List of error codes:
- \<error code\>: \<error description\>
- 500: System error
- 600: Unsupported Open Library API version
- 10001: Endpoint disabled
- 71001: Consent has not been given for 'loan history'
- 100001: Wrong patron identifier, password or pin code
- 100011: New password or pin code rejected, because it does not meet the provider's requirements
- 100013: The provider does not let the patron change the given credential
- 100023: Patron ID not found
- 100101: Patron could not be deleted, because the patron has something unresolved issue with the library (this could be anything from a loan to a fee, and so on ...)
- 100211: maxNumberOfEmailAddresses exceeded
- 100215: maxNumberOfPhoneNumbers exceeded
- 100221: Pickup location cannot contain sections
- 100411: Updating patron consent failed
- 100611: Updating patron notification settings failed
- 101001: Reservation ID not found
- 101047: Branch ID cannot be used as pick up branch
- 101053: Section ID cannot be used as pick up branch
- 102001: Loan ID not found
- 102301: Loan not renewable, because it is an interlibrary loan
- 102311: Loan not renewable, because it is reserved
- 110001: Branch ID not found
- 200001: Publication ID not found
- 200077: ui language not supported
- 200101: missing required query parameter
- 200103: invalid/unsupported query parameter value
- 300001: Initialize payment should not be used
- 300005: Initialize payment should be used
- 300009: Payment method not supported
- 300013: Payment method does not support partial payment
- 300301: Finalized payment can not de changed
- 300311: FinalizePaymentRequest.fees contains fees with the same ID
- 310001: Loan history ID not found
- 310011: Loan history ID already exists
- 330001: List ID not found
- 330011: List ID already exists
- 330101: List item ID not found
- 330111: List item ID already exists
One of: 500 · 600 · 10001 · 71001 · 100001 · 100011 · 100013 · 100023 · 100101 · 100211 · 100215 · 100221 · 100411 · 100611 · 101001 · 101047 · 101053 · 102001 · 102301 · 102311 · 110001 · 200001 · 200077 · 200101 · 200103 · 300001 · 300005 · 300009 · 300013 · 300301 · 300311 · 310001 · 310011 · 330001 · 330011 · 330101 · 330111
- infostringrequired
Starts with the text matching the error code field (defined above), and a describing text could be added.
401 Bearer token invalid, missing, or expired.
Shared response, defined once for the whole API. See the shared contract on the version page.
No response body.
404 Resource not found.
Shared response, defined once for the whole API. See the shared contract on the version page.
No response body.
429 Too many requests. The provider is rate limiting and did not carry out the request.
The response should have a Retry-After header saying how many seconds to wait. Show the patron "try again later", not an error about what they sent.
Shared response, defined once for the whole API. See the shared contract on the version page.
- Headers
- Retry-After integer
Seconds to wait before sending the request again.
No response body.