Flag a managed local account for password rotation
POST/computers/:computerId/managed-sids/:adminSid/force-password-rotation
Marks the account so its password is rotated at the next scan of the computer (sets force_expiry on the managed SID, visible in the computer details).
No request body.
Checks run in this order: domain controller (422 PasswordManagementNotSupportedError); Offline Access Management policy enabled (422 Offline Access Management is not enabled);
the account is in the admin inventory (422 Invalid Admin ID); the account has managed-password state (422 Admin has no passwords to rotate).
Same role gating as the password retrieval endpoint: superadmin and admin; user only with the
policy flag jita_or_persistent_users_can_access_passwords and as a system administrator of the computer (403 otherwise).
The built-in secureone account gets a 500 error (generic {error} body) after the flag is already saved. Use a token for a directory user.
Only POST is routed (GET is 405).
Required role: superadmin or admin; user only with the OAM policy flag and system-administrator status.
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 500
Rotation flagged.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).
No record has the :id in the path (the id is malformed or unknown). The body is the bare text Invalid <Type> ID (for example Invalid Computer ID, Invalid User ID) with Content-Type text/html; charset=utf-8, not JSON. Some routes return an empty body.
The request could not be processed, for example an id that is not a valid object id.
Unexpected error, returned in the generic {error} body. The built-in secureone account (not a directory user) gets this response; the rotation flag is saved before the audit log write fails.