Tenants

Set a tenant's password

Sets a new sign-in password for a tenant, chosen by the property manager rather than the tenant. It does not ask for the tenant's current password and does not send a reset link.

POST

https://api.portal.magicdoor.com/company-app/tenants/{tenantId}/password

Authorization

Authorizationstringrequired

Bearer token — Send your API token in the Authorization header as Bearer <token>. Requests without a valid token are rejected with 401 Unauthorized.

Path parameters

tenantIdstringrequired

The tenant. A Snowflake id, sent as a decimal string.

example: 1830472847398404096

Body

application/json

The new password. 1 to 150 characters as far as the request is concerned, but the change is refused below 5 characters.

passwordstringrequired

The password the tenant will sign in with from now on. Choose something the tenant does not already use elsewhere.

Response

200 · The tenant. The response carries the tenant record, not the password.

idstring

The tenant. This is the person, not their place on any particular lease.

activeboolean

false once the tenant has been deactivated. A deactivated tenant cannot sign in and cannot be given a new password.

emailstring

Email address. Absent when none is on file.

firstNamestring

Given name.

lastNamestring

Family name. Absent when only a first name is on file.

phonestring

Phone number, formatted for reading. Absent when none is on file.

createdstring · date-time

When the tenant record was created.

updatedstring · date-time

When the tenant record was last changed.

lastSeenstring · date-time

When the tenant last used the tenant portal. Absent when they never have.

lastPortalInvitestring · date-time

When a portal invite was last sent. Absent when none ever was.

portalStatusenum<string>

Where the tenant is in getting onto the tenant portal: notInvited (never invited), invited (invited but never signed in), active (has signed in).

notInvitedinvitedactive

chatIdstring

The tenant's conversation with the company. Absent when no conversation exists.

languagestring

ISO 639-1 language code used for messages to this tenant.

ssnstring

The tenant's Social Security number, if one was recorded. Returned in full, so treat every response containing it as sensitive. No example is shown here on purpose.

driversLicenseobject

Driver's licence details, if recorded. Returned in full, so treat it as sensitive. No example is shown here on purpose.

dateOfBirthstring · date

The tenant's date of birth, if recorded. No example is shown here on purpose.

genderenum<string>

The tenant's recorded gender. Absent when not recorded.

malefemaleotherpreferNotToSay

currentAddressobject

Where the tenant currently lives, as recorded on the tenant record. This is not derived from their lease.

emergencyContactsobject[]

People to contact in an emergency.

iconsstring[]

Icon keys a property manager has pinned to the tenant. Always present, possibly empty.

imageIdstring

The tenant's photo. Absent when they have none.

primaryLeaseIdstring

Of the tenant's leases that have not ended, the one with the highest rent. Absent when they are on none.

currentLeasesobject[]

Every lease the tenant is on that has not ended.

propertiesobject[]

The properties behind currentLeases.

unitsobject[]

The units behind currentLeases.

401 · The access token is missing, expired, or does not belong to a property manager.

404 · No tenant with that id exists for the calling company. A record that belongs to another company is reported the same way as one that does not exist. The id you asked for is in `entityId`; `detail` names only the kind of record.

400 · The password is shorter than 5 characters.

422 · The tenant has been deactivated. Reactivate them first.

Who can call it

Any property manager of the company that owns the tenant. There is no separate permission and no check that the caller is the tenant's own property manager. A tenant belonging to another company is reported as 404, the same as one that does not exist.

What it does

It replaces the stored password for the tenant's MagicDoor sign-in, and nothing else. In particular:

It does not sign the tenant out. Sessions and access tokens the tenant already holds keep working until they expire on their own. Setting a password is not a way to lock someone out — deactivate the tenant for that.
It does not ask for the old password. The property manager is not proving they know it.
It does not touch anything but the password. The tenant's leases, balances, portal status and lastSeen are unchanged.
It refuses a deactivated tenant with 422.

What the tenant is told

The new password is emailed to the tenant in clear text

MagicDoor sends the tenant a password changed notification by email and in-app chat, and the message contains the new password itself, along with a link to sign in and a warning to contact the company if they did not ask for the change. That notification cannot be unsubscribed from. Choose a password you are willing to have sit in the tenant's mailbox, and expect the tenant to change it.

The notification goes to the tenant's email address and chat. If the tenant has no email address on file, the email simply is not delivered; the password is still changed.