Magento 2 CE Customer update REST API for email address update not validating the password

Question

Magento2 CE REST API for customer information update not validating the given password with actual password, it accepts everything.

Content-Type : application/json
Authorization: Bearer "customerToken"

Method: PUT <base_url>/rest/V1/customers/:customerID

Request:
{
  "customer": {
    "id": "45338",
    "email": "[email protected]",
    "firstname": "Updatetest",
    "lastname": "Testing",
    "websiteId": 1
  },
  "password": "qawsedrf!"
}

Is any other API exist to update customer information with password validation?

Answer 1

To reset customer password you can use the following request

Content-Type : application/json
Authorization: Bearer "authToken"

Method: PUT <base_url>/rest/V1/customers/me/password

Request:
{
  "currentPassword": "string",
  "newPassword": "string"
}

Note auth token here is a value you are getting with

/V1/integration/customer/token

And for the request in your question, you should use token from

/V1/integration/admin/token