REST service: HTTP code for forcing a change of password

Question

What is the correct HTTP status code that should be returned by a REST service when:

1. The user has attempted to login with a first-time computer-generated password;
2. The password provided by user is correct;
3. The user must change the password before he/she can continue to do anything.

Answer 1

TLDR;

There is no built-in way of doing this. You will have to rely on home-made status codes and conventions.

---

I don't think that there is a built-in HTTP status code for a such thing.

All you can really do here is to return a 200 OK response and add in the content of the response body a message/code telling the user that they need to change their password. If they don't, the next time they attempt to login with the single-use password they should get a 401 unauthorized (and you can return in the body of the 401 a message telling them to change their password because they attempted to use an expired single-use password).