Migration Guide: Password confirmation for VoucherOwner email and password changes

Go-live date: 1 November 2026

From 1 November 2026, requests that changeemailor set a newpasswordwithout a validcurrent_passwordare rejected.

Because of security concerns, a VoucherOwner who changes their own email address or password must confirm their identity with their current password. The change affects the Update VoucherOwner endpoint.

TIP

The parameter is accepted already, so you can start sending it now.

Who is affected

The change applies to the VoucherOwner update endpoints when the request is made as the VoucherOwner:

Endpoint	Affected
`PUT /api/voucher_owners/me`	Yes
`PUT /api/voucher_owners/:id` called as the VoucherOwner	Yes
`PUT /api/voucher_owners/:id` called by a Multiplier or Customer	No

INFO

Updates of other fields (name, address, notification settings and so on) are not affected.

What changes

A new parameter is added to both endpoints:

Parameter	Type	Required
`current_password`	String	Yes, if the request changes `email` or sets a new `password`. Otherwise optional.

email counts as changed when the submitted address differs from the VoucherOwner's current address. Sending the unchanged address does not require current_password.

Examples

Change the email address

Before:

{
  "email": "new.address@example.com"
}

After:

{
  "email": "new.address@example.com",
  "current_password": "the-current-password"
}

Change the password

Before:

{
  "password": "the-new-password"
}

After:

{
  "password": "the-new-password",
  "current_password": "the-current-password"
}

Update other fields (unchanged)

{
  "first_name": "Erika",
  "city": "Berlin"
}

Error responses

DANGER

Ifcurrent_passwordis missing or incorrect, the API responds with HTTP 422 and aninvaliderror on thecurrent_passwordattribute. No changes are saved.

Missing:

{
  "errors": [
    {
      "code": "invalid",
      "detail": "Current password is required to update email or password",
      "source": {
        "attributes": ["current_password"],
        "pointer": "/current_password"
      }
    }
  ]
}

Incorrect:

{
  "errors": [
    {
      "code": "invalid",
      "detail": "Current password is incorrect",
      "source": {
        "attributes": ["current_password"],
        "pointer": "/current_password"
      }
    }
  ]
}

Migration checklist

Add an input field for the current password to every screen where a VoucherOwner changes their email address or password.

Send the value as current_password in the PUT request.

Handle the invalid error on current_password and show the VoucherOwner a message that lets them retry.

More information

Endpoint documentation: Update VoucherOwner

Migration Guide: Password confirmation for VoucherOwner email and password changes

Who is affected#

What changes#

Examples#

Change the email address#

Change the password#

Update other fields (unchanged)#

Error responses#

Migration checklist#

More information#

Who is affected

What changes

Examples

Change the email address

Change the password

Update other fields (unchanged)

Error responses

Migration checklist

More information