---
method: GET
path: /api/auth/password-rules
auth: none
area: authentication
---
<!-- source: internal/handlers/auth.go:746 AuthHandler.GetPasswordRules -->

# Password Rules

Returns the active password complexity configuration, so UI requirement
checkers mirror the real rules. The server remains the enforcer. This
route is rate-limited.

## Example response

```json example-response
{
  "min_length": 8,
  "require_upper": true,
  "require_lower": true,
  "require_number": true,
  "require_special": true
}
```

## Errors

| Status | Body | When |
| ------ | ---- | ---- |
| 429 | `{"error": "..."}` | rate limited |