Use setPassword() to change the password of a User or SelfServiceUser to a value that you specify. For example, a client application prompts a user to specify a different password, and then invokes setPassword() for an admin to change the user’s password. Use resetPassword() instead if you want to reset the password with a random value generated by the API.
This call can be used to allow users to change their own passwords, as long as their org’s Password Policies setting Allow use of setPassword() API for self-resets is enabled. Otherwise, use changeOwnPassword(), which is more secure because it verifies the user’s current password before allowing the change.
Your client application must be logged in with sufficient access rights to change the password for the specified user. For more information, see Factors that Affect Data Access.