OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Authentication

Change user password

  • Sandbox: available
  • Staging: available
  • Production: unknown
PATCH
/v2/auth/change-password

Changes the password of the signed-in user. Use it from an account settings screen where the user knows their current password.

Auth: bearer token. Scope: the User of the token.

Behaviour

  • oldPassword must match the current password. A wrong oldPassword, or an account with no password set, gives 401.
  • The new password may equal the old one.
  • The password must have at least 12 characters, not counting spaces at either end, and must not be on Ovok's list of common and breached passwords. Any character is allowed and none is required. A refused password answers 422 with the error on newPassword.
  • The route does not end existing sessions.
  • The email address is not marked as verified by this route.
  • The response is the updated User without its password hash.

Example

curl -X PATCH 'https://api.sandbox.ovok.com/v2/auth/change-password' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \  -H 'Content-Type: application/json' \  -d '{    "oldPassword": "Ex4mple-Passw0rd",    "newPassword": "a-new-password"  }'

Authorization

bearer
headerAuthorizationBearer <JWT>

Request Body

application/json
  1. body
oldPassword*string
newPassword*string
Length12 <= length <= 128

Response Body

User password change confirmation.

Example Request
curl -X PATCH 'https://api.sandbox.ovok.com/v2/auth/change-password' \  -H 'Content-Type: application/json' \  -d '{  "oldPassword": "string",  "newPassword": "stringstring"}'
Example Response
Empty

Translate text POST

Translates a list of strings from one language to another with an LLM. Use it to draft translations for content and localization keys. **Auth:** bearer token. **Scope:** the caller's project (from the token). The project's settings can add instructions to the translation prompt. ## Behaviour - `sourceLanguage` and `targetLanguage` take a language code such as `en` or `de-DE`, or a language name. Each is 2 to 100 characters. - `text` holds 1 or more strings. Each string and all strings together are limited to 10,000 characters. - Strings can be plain text, HTML or Markdown, and can contain placeholders such as `{{name}}`. Markup and placeholders are meant to be kept as they are, but the output comes from an LLM, so check it before you publish it. - The response returns the translations in `text`, in the same order as the input. - If the project has a setting named `TRANSLATION_ADDITIONAL_PROMPT`, its value is added to the prompt for every translation in that project. - Nothing is stored. The route only returns the translation. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/ai/translation' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "sourceLanguage": "en", "targetLanguage": "de", "text": ["Hello {{name}}, how are you?", "<p>Your appointment is <b>today</b>.</p>"] }' ```

Refresh access token POST

Exchanges a refresh token for a new access token and a new refresh token. Call it before the access token expires to keep a session alive. **Auth:** none. The refresh token in the body is the credential. ## Behaviour - Ovok forwards the token to Medplum's `oauth2/token` endpoint (`grant_type=refresh_token`, scope `openid offline_access`). - The request body takes the token as `refresh_token`. - The response holds `accessToken`, `refreshToken` and `expiresIn` (seconds), the same names the login routes use. Store the new `refreshToken`: use it for the next refresh. - The response also carries the same three values as `access_token`, `refresh_token` and `expires_in`. Those names are deprecated and will be removed in a later release: read the camelCase ones. - A refresh token Medplum refuses (spent, expired, revoked, or not a refresh token at all) gives a 401 with Medplum's error description. A refresh token is single-use, so retrying it after a successful refresh also gives a 401: sign in again. - A body without `refresh_token` gives a 400. - A session of a Patient whose project turned `PATIENT_LOGIN_ENABLED` off, or of a Practitioner whose project turned `PRACTITIONER_LOGIN_ENABLED` off, gives a 403 `Login is not enabled for this project.` That ends the session: the refresh token is used up, and signing in again is refused while login is off. A Practitioner who is a project admin is not refused, so an admin who is signed in can still turn login back on (they cannot sign in again while it is off). The access token already issued lasts until it expires (60 minutes). - `POST /oauth2/token` applies the same check to every token it grants (refresh and code exchange), answering `403 { "error": "access_denied", "error_description": "Login is not enabled for this project." }`. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/auth/refresh-token' \ -H 'Content-Type: application/json' \ -d '{ "refresh_token": "example.jwt.eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk" }' ```