GET /obp/v7.0.0/public/password-config

Returns the password policy this instance enforces when a password is set (user creation and password reset).

A password is valid if it satisfies AT LEAST ONE of the policies. For each policy:

min_length / max_length — inclusive length bounds.
required_character_classes — the password must contain at least one character matching each class regex.
allowed_characters — every character of the password must be one of these.
regex — a single pattern equivalent to the three rules above, written in a portable regex subset that behaves identically in Java, JavaScript and Python, so it can be used verbatim.

The structured fields are the normative contract; regex is a convenience. Clients can use either to give immediate feedback while a user types a new password. The server remains the final enforcer: a password failing the policy is rejected with OBP-30207 (InvalidStrongPasswordFormat).

The policy applies only when a password is set; already-stored passwords are never re-checked against it (we don't store the password in plain text).

No Authentication is Required.

User Authentication is Optional. The User need not be logged in.

{ "description": "A password must satisfy at least one of the policies: 10 to 16 characters including at least one digit, one lower case letter, one upper case letter and one special character - or a passphrase of 17 to 512 characters.", "policies": [ { "description": "10 to 16 characters (printable ASCII, no space) including at least one digit, one lower case letter, one upper case letter and one special character.", "min_length": 10, "max_length": 16, "required_character_classes": [ { "name": "digit", "regex": "[0-9]" }, { "name": "lowercase letter", "regex": "[a-z]" }, { "name": "uppercase letter", "regex": "[A-Z]" }, { "name": "special character", "regex": "[\\x21-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\x7e]" } ], "allowed_characters": "!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~", "regex": "^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[\\x21-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\x7e])[\\x21-\\x7e]{10,16}$" }, { "description": "A passphrase of 17 to 512 characters (printable ASCII, no space), no composition rules.", "min_length": 17, "max_length": 512, "required_character_classes": [], "allowed_characters": "!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~", "regex": "^[\\x21-\\x7e]{17,512}$" } ] }