feat: add notification policy and password change message (#5065)

Implementation of new notification policy with functionality to send email when a password is changed
2025-08-12 04:17:32 +00:00 · 2023-01-25 09:49:41 +01:00
parent 8b5894c0bb
commit 19621acfd3
73 changed files with 4196 additions and 83 deletions
--- a/docs/docs/apis/proto/admin.md
+++ b/docs/docs/apis/proto/admin.md
@@ -1072,6 +1072,44 @@ Variable {{.Lang}} can be set to have different links based on the language
    PUT: /policies/privacy


+### AddNotificationPolicy
+
+> **rpc** AddNotificationPolicy([AddNotificationPolicyRequest](#addnotificationpolicyrequest))
+[AddNotificationPolicyResponse](#addnotificationpolicyresponse)
+
+Add a default notification policy for ZITADEL
+it impacts all organisations without a customised policy
+
+
+
+    POST: /policies/notification
+
+
+### GetNotificationPolicy
+
+> **rpc** GetNotificationPolicy([GetNotificationPolicyRequest](#getnotificationpolicyrequest))
+[GetNotificationPolicyResponse](#getnotificationpolicyresponse)
+
+Returns the notification policy defined by the administrators of ZITADEL
+
+
+
+    GET: /policies/notification
+
+
+### UpdateNotificationPolicy
+
+> **rpc** UpdateNotificationPolicy([UpdateNotificationPolicyRequest](#updatenotificationpolicyrequest))
+[UpdateNotificationPolicyResponse](#updatenotificationpolicyresponse)
+
+Updates the default notification policy of ZITADEL
+it impacts all organisations without a customised policy
+
+
+
+    PUT: /policies/notification
+
+
 ### GetDefaultInitMessageText

 > **rpc** GetDefaultInitMessageText([GetDefaultInitMessageTextRequest](#getdefaultinitmessagetextrequest))
@@ -1104,7 +1142,7 @@ Returns the custom text for initial message (overwritten in eventstore)
 Sets the default custom text for initial message
 it impacts all organisations without customized initial message text
 The Following Variables can be used:
-{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -1156,7 +1194,7 @@ Returns the custom text for password reset message (overwritten in eventstore)
 Sets the default custom text for password reset message
 it impacts all organisations without customized password reset message text
 The Following Variables can be used:
-{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -1208,7 +1246,7 @@ Returns the custom text for verify email message (overwritten in eventstore)
 Sets the default custom text for verify email message
 it impacts all organisations without customized verify email message text
 The Following Variables can be used:
-{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -1260,7 +1298,7 @@ Returns the custom text for verify phone message
 Sets the default custom text for verify phone message
 it impacts all organisations without customized verify phone message text
 The Following Variables can be used:
-{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -1309,10 +1347,10 @@ Returns the custom text for domain claimed message (overwritten in eventstore)
 > **rpc** SetDefaultDomainClaimedMessageText([SetDefaultDomainClaimedMessageTextRequest](#setdefaultdomainclaimedmessagetextrequest))
 [SetDefaultDomainClaimedMessageTextResponse](#setdefaultdomainclaimedmessagetextresponse)

-Sets the default custom text for domain claimed phone message
+Sets the default custom text for domain claimed message
 it impacts all organisations without customized domain claimed message text
 The Following Variables can be used:
-{{.Domain}} {{.TempUsername}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Domain}} {{.TempUsername}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -1364,7 +1402,7 @@ Returns the custom text for passwordless registration message (overwritten in ev
 Sets the default custom text for passwordless registration message
 it impacts all organisations without customized passwordless registration message text
 The Following Variables can be used:
-{{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -1384,6 +1422,58 @@ The default text from the translation file will trigger after
    DELETE: /text/message/passwordless_registration/{language}


+### GetDefaultPasswordChangeMessageText
+
+> **rpc** GetDefaultPasswordChangeMessageText([GetDefaultPasswordChangeMessageTextRequest](#getdefaultpasswordchangemessagetextrequest))
+[GetDefaultPasswordChangeMessageTextResponse](#getdefaultpasswordchangemessagetextresponse)
+
+Returns the default text for password change message (translation file)
+
+
+
+    GET: /text/default/message/password_change/{language}
+
+
+### GetCustomPasswordChangeMessageText
+
+> **rpc** GetCustomPasswordChangeMessageText([GetCustomPasswordChangeMessageTextRequest](#getcustompasswordchangemessagetextrequest))
+[GetCustomPasswordChangeMessageTextResponse](#getcustompasswordchangemessagetextresponse)
+
+Returns the custom text for password change message (overwritten in eventstore)
+
+
+
+    GET: /text/message/password_change/{language}
+
+
+### SetDefaultPasswordChangeMessageText
+
+> **rpc** SetDefaultPasswordChangeMessageText([SetDefaultPasswordChangeMessageTextRequest](#setdefaultpasswordchangemessagetextrequest))
+[SetDefaultPasswordChangeMessageTextResponse](#setdefaultpasswordchangemessagetextresponse)
+
+Sets the default custom text for password change message
+it impacts all organisations without customized password change message text
+The Following Variables can be used:
+{{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}
+
+
+
+    PUT: /text/message/password_change/{language}
+
+
+### ResetCustomPasswordChangeMessageTextToDefault
+
+> **rpc** ResetCustomPasswordChangeMessageTextToDefault([ResetCustomPasswordChangeMessageTextToDefaultRequest](#resetcustompasswordchangemessagetexttodefaultrequest))
+[ResetCustomPasswordChangeMessageTextToDefaultResponse](#resetcustompasswordchangemessagetexttodefaultresponse)
+
+Removes the custom password change message text of the system
+The default text from the translation file will trigger after
+
+
+
+    DELETE: /text/message/password_change/{language}
+
+
 ### GetDefaultLoginTexts

 > **rpc** GetDefaultLoginTexts([GetDefaultLoginTextsRequest](#getdefaultlogintextsrequest))
@@ -1793,6 +1883,28 @@ This is an empty request



+### AddNotificationPolicyRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| password_change |  bool | - |  |
+
+
+
+
+### AddNotificationPolicyResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### AddOIDCIDPRequest


@@ -2210,6 +2322,28 @@ This is an empty request



+### GetCustomPasswordChangeMessageTextRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| language |  string | - | string.min_len: 1<br /> string.max_len: 200<br />  |
+
+
+
+
+### GetCustomPasswordChangeMessageTextResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| custom_text |  zitadel.text.v1.MessageCustomText | - |  |
+
+
+
+
 ### GetCustomPasswordResetMessageTextRequest


@@ -2398,6 +2532,28 @@ This is an empty request



+### GetDefaultPasswordChangeMessageTextRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| language |  string | - | string.min_len: 1<br /> string.max_len: 200<br />  |
+
+
+
+
+### GetDefaultPasswordChangeMessageTextResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| custom_text |  zitadel.text.v1.MessageCustomText | - |  |
+
+
+
+
 ### GetDefaultPasswordResetMessageTextRequest


@@ -2627,6 +2783,23 @@ This is an empty request



+### GetNotificationPolicyRequest
+This is an empty request
+
+
+
+
+### GetNotificationPolicyResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| policy |  zitadel.policy.v1.NotificationPolicy | - |  |
+
+
+
+
 ### GetOIDCSettingsRequest
 This is an empty request

@@ -3839,6 +4012,28 @@ this is en empty request



+### ResetCustomPasswordChangeMessageTextToDefaultRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| language |  string | - | string.min_len: 1<br /> string.max_len: 200<br />  |
+
+
+
+
+### ResetCustomPasswordChangeMessageTextToDefaultResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### ResetCustomPasswordResetMessageTextToDefaultRequest


@@ -4085,6 +4280,35 @@ this is en empty request



+### SetDefaultPasswordChangeMessageTextRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| language |  string | - | string.min_len: 1<br /> string.max_len: 200<br />  |
+| title |  string | - | string.max_len: 200<br />  |
+| pre_header |  string | - | string.max_len: 200<br />  |
+| subject |  string | - | string.max_len: 200<br />  |
+| greeting |  string | - | string.max_len: 200<br />  |
+| text |  string | - | string.max_len: 800<br />  |
+| button_text |  string | - | string.max_len: 200<br />  |
+| footer_text |  string | - | string.max_len: 200<br />  |
+
+
+
+
+### SetDefaultPasswordChangeMessageTextResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### SetDefaultPasswordResetMessageTextRequest


@@ -4581,6 +4805,28 @@ this is en empty request



+### UpdateNotificationPolicyRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| password_change |  bool | - |  |
+
+
+
+
+### UpdateNotificationPolicyResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### UpdateOIDCSettingsRequest


--- a/docs/docs/apis/proto/management.md
+++ b/docs/docs/apis/proto/management.md
@@ -2231,7 +2231,7 @@ Variable {{.Lang}} can be set to have different links based on the language
 > **rpc** UpdateCustomPrivacyPolicy([UpdateCustomPrivacyPolicyRequest](#updatecustomprivacypolicyrequest))
 [UpdateCustomPrivacyPolicyResponse](#updatecustomprivacypolicyresponse)

-Update the privacy complexity policy for the organisation
+Update the privacy policy for the organisation
 With this policy privacy relevant things can be configured (e.g. tos link)
 Variable {{.Lang}} can be set to have different links based on the language

@@ -2253,6 +2253,71 @@ The default policy of the IAM will trigger after
    DELETE: /policies/privacy


+### GetNotificationPolicy
+
+> **rpc** GetNotificationPolicy([GetNotificationPolicyRequest](#getnotificationpolicyrequest))
+[GetNotificationPolicyResponse](#getnotificationpolicyresponse)
+
+Returns the notification policy of the organisation
+With this notification policy it can be configured how users should be notified
+
+
+
+    GET: /policies/notification
+
+
+### GetDefaultNotificationPolicy
+
+> **rpc** GetDefaultNotificationPolicy([GetDefaultNotificationPolicyRequest](#getdefaultnotificationpolicyrequest))
+[GetDefaultNotificationPolicyResponse](#getdefaultnotificationpolicyresponse)
+
+Returns the default notification policy of the IAM
+With this notification privacy it can be configured how users should be notified
+
+
+
+    GET: /policies/default/notification
+
+
+### AddCustomNotificationPolicy
+
+> **rpc** AddCustomNotificationPolicy([AddCustomNotificationPolicyRequest](#addcustomnotificationpolicyrequest))
+[AddCustomNotificationPolicyResponse](#addcustomnotificationpolicyresponse)
+
+Add a custom notification policy for the organisation
+With this notification privacy it can be configured how users should be notified
+
+
+
+    POST: /policies/notification
+
+
+### UpdateCustomNotificationPolicy
+
+> **rpc** UpdateCustomNotificationPolicy([UpdateCustomNotificationPolicyRequest](#updatecustomnotificationpolicyrequest))
+[UpdateCustomNotificationPolicyResponse](#updatecustomnotificationpolicyresponse)
+
+Update the notification policy for the organisation
+With this notification privacy it can be configured how users should be notified
+
+
+
+    PUT: /policies/notification
+
+
+### ResetNotificationPolicyToDefault
+
+> **rpc** ResetNotificationPolicyToDefault([ResetNotificationPolicyToDefaultRequest](#resetnotificationpolicytodefaultrequest))
+[ResetNotificationPolicyToDefaultResponse](#resetnotificationpolicytodefaultresponse)
+
+Removes the notification policy of the organisation
+The default policy of the IAM will trigger after
+
+
+
+    DELETE: /policies/notification
+
+
 ### GetLabelPolicy

 > **rpc** GetLabelPolicy([GetLabelPolicyRequest](#getlabelpolicyrequest))
@@ -2485,7 +2550,7 @@ Returns the default text for password reset message

 Sets the custom text for password reset message
 The Following Variables can be used:
-{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -2536,7 +2601,7 @@ Returns the default text for verify email message

 Sets the custom text for verify email message
 The Following Variables can be used:
-{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -2587,7 +2652,7 @@ Returns the custom text for verify email message

 Sets the default custom text for verify email message
 The Following Variables can be used:
-{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Code}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -2638,7 +2703,7 @@ Returns the custom text for domain claimed message

 Sets the custom text for domain claimed message
 The Following Variables can be used:
-{{.Domain}} {{.TempUsername}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.Domain}} {{.TempUsername}} {{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -2689,7 +2754,7 @@ Returns the custom text for passwordless link message

 Sets the custom text for passwordless link message
 The Following Variables can be used:
-{{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}}
+{{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}



@@ -2709,6 +2774,57 @@ The default text of the IAM will trigger after
    DELETE: /text/message/passwordless_registration/{language}


+### GetCustomPasswordChangeMessageText
+
+> **rpc** GetCustomPasswordChangeMessageText([GetCustomPasswordChangeMessageTextRequest](#getcustompasswordchangemessagetextrequest))
+[GetCustomPasswordChangeMessageTextResponse](#getcustompasswordchangemessagetextresponse)
+
+Returns the custom text for password change message
+
+
+
+    GET: /text/message/password_change/{language}
+
+
+### GetDefaultPasswordChangeMessageText
+
+> **rpc** GetDefaultPasswordChangeMessageText([GetDefaultPasswordChangeMessageTextRequest](#getdefaultpasswordchangemessagetextrequest))
+[GetDefaultPasswordChangeMessageTextResponse](#getdefaultpasswordchangemessagetextresponse)
+
+Returns the custom text for password change link message
+
+
+
+    GET: /text/default/message/password_change/{language}
+
+
+### SetCustomPasswordChangeMessageCustomText
+
+> **rpc** SetCustomPasswordChangeMessageCustomText([SetCustomPasswordChangeMessageTextRequest](#setcustompasswordchangemessagetextrequest))
+[SetCustomPasswordChangeMessageTextResponse](#setcustompasswordchangemessagetextresponse)
+
+Sets the custom text for password change message
+The Following Variables can be used:
+{{.UserName}} {{.FirstName}} {{.LastName}} {{.NickName}} {{.DisplayName}} {{.LastEmail}} {{.VerifiedEmail}} {{.LastPhone}} {{.VerifiedPhone}} {{.PreferredLoginName}} {{.LoginNames}} {{.ChangeDate}} {{.CreationDate}}
+
+
+
+    PUT: /text/message/password_change/{language}
+
+
+### ResetCustomPasswordChangeMessageTextToDefault
+
+> **rpc** ResetCustomPasswordChangeMessageTextToDefault([ResetCustomPasswordChangeMessageTextToDefaultRequest](#resetcustompasswordchangemessagetexttodefaultrequest))
+[ResetCustomPasswordChangeMessageTextToDefaultResponse](#resetcustompasswordchangemessagetexttodefaultresponse)
+
+Removes the custom password change message text of the organisation
+The default text of the IAM will trigger after
+
+
+
+    DELETE: /text/message/password_change/{language}
+
+
 ### GetCustomLoginTexts

 > **rpc** GetCustomLoginTexts([GetCustomLoginTextsRequest](#getcustomlogintextsrequest))
@@ -3226,6 +3342,28 @@ This is an empty request



+### AddCustomNotificationPolicyRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| password_change |  bool | - |  |
+
+
+
+
+### AddCustomNotificationPolicyResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### AddCustomPasswordAgePolicyRequest


@@ -4446,6 +4584,28 @@ This is an empty request



+### GetCustomPasswordChangeMessageTextRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| language |  string | - | string.min_len: 1<br /> string.max_len: 200<br />  |
+
+
+
+
+### GetCustomPasswordChangeMessageTextResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| custom_text |  zitadel.text.v1.MessageCustomText | - |  |
+
+
+
+
 ### GetCustomPasswordResetMessageTextRequest


@@ -4651,6 +4811,23 @@ This is an empty request



+### GetDefaultNotificationPolicyRequest
+This is an empty request
+
+
+
+
+### GetDefaultNotificationPolicyResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| policy |  zitadel.policy.v1.NotificationPolicy | - |  |
+
+
+
+
 ### GetDefaultPasswordAgePolicyRequest
 This is an empty request

@@ -4668,6 +4845,28 @@ This is an empty request



+### GetDefaultPasswordChangeMessageTextRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| language |  string | - | string.min_len: 1<br /> string.max_len: 200<br />  |
+
+
+
+
+### GetDefaultPasswordChangeMessageTextResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| custom_text |  zitadel.text.v1.MessageCustomText | - |  |
+
+
+
+
 ### GetDefaultPasswordComplexityPolicyRequest
 This is an empty request

@@ -5034,6 +5233,23 @@ This is an empty request



+### GetNotificationPolicyRequest
+This is an empty request
+
+
+
+
+### GetNotificationPolicyResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| policy |  zitadel.policy.v1.NotificationPolicy | - |  |
+
+
+
+
 ### GetOIDCInformationRequest
 This is an empty request

@@ -7442,6 +7658,28 @@ This is an empty request



+### ResetCustomPasswordChangeMessageTextToDefaultRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| language |  string | - | string.min_len: 1<br /> string.max_len: 200<br />  |
+
+
+
+
+### ResetCustomPasswordChangeMessageTextToDefaultResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### ResetCustomPasswordResetMessageTextToDefaultRequest


@@ -7581,6 +7819,23 @@ This is an empty request



+### ResetNotificationPolicyToDefaultRequest
+This is an empty request
+
+
+
+
+### ResetNotificationPolicyToDefaultResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### ResetPasswordAgePolicyToDefaultRequest
 This is an empty request

@@ -7791,6 +8046,35 @@ This is an empty request



+### SetCustomPasswordChangeMessageTextRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| language |  string | - | string.min_len: 1<br /> string.max_len: 200<br />  |
+| title |  string | - | string.max_len: 200<br />  |
+| pre_header |  string | - | string.max_len: 200<br />  |
+| subject |  string | - | string.max_len: 200<br />  |
+| greeting |  string | - | string.max_len: 200<br />  |
+| text |  string | - | string.max_len: 800<br />  |
+| button_text |  string | - | string.max_len: 200<br />  |
+| footer_text |  string | - | string.max_len: 200<br />  |
+
+
+
+
+### SetCustomPasswordChangeMessageTextResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### SetCustomPasswordResetMessageTextRequest


@@ -8234,6 +8518,28 @@ This is an empty request



+### UpdateCustomNotificationPolicyRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| password_change |  bool | - |  |
+
+
+
+
+### UpdateCustomNotificationPolicyResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+
+
+
+
 ### UpdateCustomPasswordAgePolicyRequest


--- a/docs/docs/apis/proto/policy.md
+++ b/docs/docs/apis/proto/policy.md
@@ -95,6 +95,19 @@ title: zitadel/policy.proto



+### NotificationPolicy
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details |  zitadel.v1.ObjectDetails | - |  |
+| is_default |  bool | - |  |
+| password_change |  bool | - |  |
+
+
+
+
 ### OrgIAMPolicy
 deprecated: please use DomainPolicy instead

--- a/docs/docs/guides/manage/console/instance-settings.mdx
+++ b/docs/docs/guides/manage/console/instance-settings.mdx
@@ -15,7 +15,7 @@ To access instance settings, use the instance page at `{instanceDomain}/ui/conso
 When you configure your instance, you can set the following:

 - **General**: Default Language for the UI
- [**Notification providers and SMTP**](#notification-providers-and-smtp): Email Server settings, so initialization-, verification- and other mails are sent from your own domain. For SMS, Twilio is supported as notification provider.
+- [**Notification settings**](#notification-providers-and-smtp): Notification and Email Server settings, so initialization-, verification- and other mails are sent from your own domain. For SMS, Twilio is supported as notification provider.
 - [**Login Behaviour and Access**](#login-behaviour-and-access): Multifactor Authentication Options and Enforcement, Define whether Passwordless authentication methods are allowed or not, Set Login Lifetimes and advanced behavour for the login interface.
 - [**Identity Providers**](#identity-providers): Define IDPs which are available for all organizations
 - [**Password Complexity**](#password-complexity): Requirements for Passwords ex. Symbols, Numbers, min length and more.
@@ -48,9 +48,16 @@ Make sure you click the "Apply configuration" button after you finish your confi

 Branding settings applied on you instance act as a default for all your organizations. If you need custom branding on a organization take a look at our guide under [organization settiong](./organizations#branding).

-## Notification providers and SMTP
+## Notification settings

-In the notification settings you can configure your SMTP Server settings and your SMS Provider. At the moment Twilio is available as SMS provider.
+In the notification settings you can configure when to notify users about certain events and you can customize your SMTP Server settings and your SMS Provider.
+At the moment Twilio is available as SMS provider.
+
+### Notification
+
+You can configure on which changes the users will be notified. The text of the message can be changed in the [Message texts](#message-texts)
+
+<img src="/docs/img/guides/console/notification.png" alt="Notification" width="400px" />

 ### SMTP

@@ -197,13 +204,14 @@ Example:

 These are the texts for your notification mails. Available for change are:

-| Message Text   | Description                                                                                                      |
-| -------------- | ---------------------------------------------------------------------------------------------------------------- |
-| Domain Claim   | Enable self register possibility in the login ui                                                                 |
-| Initialization | The mail after a user has been created. A code is part of the message which then must be verified on first login |
-| Passwordless   | Possibility to login with an external identity (e.g Google, Microsoft, Apple, etc)                               |
-| Password Reset | Force a user to register and use a multifactor authentication                                                    |
-| Verify Email   | Choose if passwordless login is allowed or not                                                                   |
+| Message Text    | Description                                                                                                                |
+| --------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| Domain Claim    | The Mail after an organisation claimed a domain for itself. Users on other organisations with this domain will be notified |
+| Initialization  | The mail after a user has been created. A code is part of the message which then must be verified on first login           |
+| Passwordless    | The Mail to register an additional passwordless device by a link                                                           |
+| Password Reset  | The Mail to reset the password by a link                                                                                   |
+| Verify Email    | The mail after the email has been changed. A code is part of the message which then must be verified on the next login     |
+| Password Change | Notify the user, that the password has been changed. Can be configured in [Notification](#notification)                    |

 You can set the locale of the translations on the right.

--- a/docs/static/img/guides/console/notification.png
+++ b/docs/static/img/guides/console/notification.png