I remember suggesting a different and simpler "API" - all websites (etc) should be able to parse the concatenation "oldpasswordnewpassword"or perhaps oldpassword_newpassword" where "_" is any character reserved for a delimiter. The website would then swap the new password for the old one.
Of course, other implementations of the same idea using other ways of distinguishing old and new are possible, too.
Of course, other implementations of the same idea using other ways of distinguishing old and new are possible, too.