Users

Request an email address change

Initiate an email-address change for the authenticated end-user. The user must supply their current password. If the credentials are correct and the new address is not already taken within the same project, Mudbase: - Sends a 6-digit confirmation code to the **new** address (expires in 10 minutes). - Sends a cancel notice with a single-use abort link to the **current** address (valid for 25 hours). Only one pending change request exists per user at a time. A new request cancels any previous pending one. **Rate limit:** 3 requests per user (or IP) per hour. **Restriction:** accounts that authenticate exclusively through a linked provider (no local password) are rejected with code `NO_PASSWORD`.

AuthBearer (JWT)
GroupUsers
Rate limitSee Rate Limits
POST/api/users/email-change/request

SDK setup

Create a client and set credentials (JWT and/or API key) before calling the API. Match the authentication type shown above.

import { Configuration, UsersApi } from 'mudbase-sdk';

const configuration = new Configuration({
  basePath: 'https://cloud.mudbase.dev',
  accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfbW9yZ2FuX2RlIiwiZW1haWwiOiJtb3JnYW4uY2hlbkBub3J0aHdpbmQuZGV2IiwiZXhwIjoxODI1MTI5NjAwfQ.doc_preview_sig',
});

const users = new UsersApi(configuration);

Example request

Call this endpoint using the client from SDK setup. Use View HTTP for a raw cURL example.

const { data: result } = await users.requestEmailChange(
  {
    currentPassword: "Str0ng_Sample_Pass!w0rd",
    newEmail: "yessenia.brekke76@northwind.dev"
  }
);

Playground

live

Test this endpoint with your own credentials. Your requests will be sent to the live API.

Use the auth endpoints to obtain a JWT.

No Request Yet

Send a request to see the full inspector

Authentication

Requires JWT
Note
Include your JWT in the Authorization: Bearer YOUR_TOKEN header (user-facing apps, RBAC). View authentication guide →

Request Body

json
{
  "currentPassword": "MyCurrentP@ss1",
  "newEmail": "new-address@example.com"
}

Responses

200Code sent successfully
json
{
  "message": "A confirmation code has been sent to your new email address."
}
400Bad request. The `code` field indicates the specific failure: | Code | Meaning | |------|---------| | `WRONG_PASSWORD` | The supplied `currentPassword` is incorrect. | | `NO_PASSWORD` | The account has no local password (SSO or OAuth-only). | | `SAME_EMAIL` | The new email is the same as the current one. |
json
{
  "error": "program back up",
  "code": "WRONG_PASSWORD"
}
401-
409Conflict. `code: EMAIL_TAKEN` means another user in the same project already uses that address. Email uniqueness is scoped per project.
json
{
  "error": "program back up",
  "code": "EMAIL_TAKEN"
}
429-

Errors

CodeMeaning
400Bad request. The `code` field indicates the specific failure: | Code | Meaning | |------|---------| | `WRONG_PASSWORD` | The supplied `currentPassword` is incorrect. | | `NO_PASSWORD` | The account has no local password (SSO or OAuth-only). | | `SAME_EMAIL` | The new email is the same as the current one. |
401-
409Conflict. `code: EMAIL_TAKEN` means another user in the same project already uses that address. Email uniqueness is scoped per project.
429-
Run in PostmanDownload OpenAPI

Next

NEXT →API Reference OverviewBase URL, rate limits, pagination, and the full endpoint index.NEXT →AuthenticationAPI keys, Bearer tokens, and user sessions.NEXT →API PlaygroundSearch any endpoint and send a live request.
Edit this page on GitHub
Chat with us