---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce password reset on API requests

# Enforce password reset on API requests {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Manage how the password reset functionality operates on your instance.
When a user is marked for Password needs reset they must provide a new password at the next authentication attempt. The glide.authenticate.api.user.reset_password.mandatory system property controls whether the
password reset is mandatory before making API calls. If glide.authenticate.api.user.reset_password.mandatory isn't set to the recommended value of true, then user accounts marked as
Password needs reset can still perform most common operations by querying the table API through basic authentication.

Ensure the property glide.authenticate.api.user.reset_password.mandatory is set to true.

## More information {#sc-enforce-password-reset-on-api-requests__section_ghv_dvg_1xb}

{#sc-enforce-password-reset-on-api-requests__table_hhv_dvg_1xb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.api.user.reset_password.mandatory |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 8.1 * CVSS score: High * Security risk details: This could allow information disclosure in the event that stale accounts are compromised. {#sc-enforce-password-reset-on-api-requests__ul_ihv_dvg_1xb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-enforce-password-reset-on-api-requests__table_hhv_dvg_1xb}