Hi RestTest,

Currently there is no way to change/reset user password from the REST API. It is possible, however, to disable a user account via the REST API - simply update the User object, setting the IsActive field to false. Here is a PHP sample that does this:

<?php
// I'm getting credentials etc from environment variables
// Hardcode them if you must...
define("SF_SECURITY_TOKEN", getenv("SECURITY_TOKEN"));
define("SF_USERNAME", getenv("USERNAME"));
define("SF_PASSWORD", getenv("PASSWORD"));

define("CLIENT_ID", getenv("CLIENT_ID"));
define("CLIENT_SECRET", getenv("CLIENT_SECRET"));
define("LOGIN_URI", getenv("LOGIN_SERVER"));

function salesforce_login($username, $password) {
    $params = 'grant_type=password' .
    	'&client_id=' . CLIENT_ID .
		'&client_secret=' . CLIENT_SECRET .
		'&username=' . urlencode($username) .
		'&password=' . urlencode($password);
    
    $token_url = LOGIN_URI . "/services/oauth2/token";
    // $token_url = "http://www.postbin.org/106jphp";
    
    $curl = curl_init($token_url);
    curl_setopt($curl, CURLOPT_HEADER, false);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, $params);
	//curl_setopt($curl, CURLOPT_PROXY, "http://localhost:8888/");
	//curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);
    $json_response = curl_exec($curl);
    $status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    if ( $status != 200 ) {
    	echo 'token_url = ' . $token_url . "\n";
    	echo 'params = ' . $params . "\n";
        echo 'response = ' . $json_response . "\n";
        die("Error: call to URL $token_url failed with status $status\n");
    }
    curl_close($curl);
    
    return json_decode($json_response, true);
}

echo "Logging in as ".SF_USERNAME."\n";

$response = salesforce_login(SF_USERNAME, SF_PASSWORD.SF_SECURITY_TOKEN);

$instance_url = $response['instance_url'];
$access_token = $response['access_token'];

// Change the following ID to a user in your org
$user = "00550000001oZ9v";

$url = "$instance_url/services/data/v20.0/sobjects/User/$user";

// Set IsActive to false to disable the user account, true to enable it
$content = json_encode(array("IsActive" => false));

$curl = curl_init($url);
curl_setopt($curl, CURLOPT_HEADER, false);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HTTPHEADER,
        array("Authorization: OAuth $access_token",
            "Content-type: application/json"));
curl_setopt($curl, CURLOPT_CUSTOMREQUEST, "PATCH");
curl_setopt($curl, CURLOPT_POSTFIELDS, $content);

$response = curl_exec($curl);

$status = curl_getinfo($curl, CURLINFO_HTTP_CODE);

if ( $status != 204 ) {
    die("Error: call to URL $url failed with status $status, response $response\n");
}

echo "Successfully updated user $user\n";

curl_close($curl);
?>

Cheers,

Pat