hosting
POST /v1/sites/{siteId}/databases/{databaseId}/password
Set a new password on a site database's user.
Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/databases/{databaseId}/password \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Generates a new password for the database's user, sets it at the vendor, and returns it **once**. Before this operation existed the only remedy for a lost database password was `deleteSiteDatabase` followed by a fresh create — data loss offered as a password reset. ⛔ **`POST`, and there is deliberately no `GET`.** The password is generated for this call and stored nowhere, so there is nothing a second read could return. The response is the one on this surface that carries a live credential: it is served to the one principal entitled to the site, and a client must hold it in component state until the customer confirms they have saved it — never in a query cache, which would let it survive the dismissal and land in any state snapshot taken for support. `404` for a site with no vendor hosting package, one that is not the caller's, or a database id that is not on it. Requires `sites.view` **and** `sites.panel_access`, the same key that governs creating and dropping the database it belongs to.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
databaseId (path) | string | Yes | The database id returned by `listSiteDatabases`. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
database_id | string | Yes | The database's id at the vendor, as `listSiteDatabases` reports it. |
database_name | string | Yes | The database's name. The vendor namespaces it per package on some package types, so this — not what was requested when it was created — is what a client shows. |
username | string | Yes | The user the password belongs to. |
password | string | Yes | The new password, in cleartext, returned exactly once. |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429 · 503