Authenticated password rotation.
Requires the current password; a stolen session key alone must
not let an attacker rotate. Other active sessions are
intentionally left intact — voluntary rotation is not the
same threat model as compromise recovery (use
/auth/request-password-reset for the latter).
Documentation Index
Fetch the complete documentation index at: https://docs.roughy.ai/llms.txt
Use this file to discover all available pages before exploring further.
An API key — either a programmatic key minted via POST /api-keys or a session-class key minted by POST /auth/login / an OAuth callback. Pass it as Authorization: Bearer <token>. UI flows can omit the header — the roughy_session HttpOnly cookie set by login + OAuth callbacks is read as a fallback.
Successful Response