Hi @cweeks,
Based on the transaction model mentioned in the following link https://developer.okta.com/docs/api/resources/authn#transaction-model, you can’t change the password state and to change the password using stateToken, the state of the user needs to be either password_expired or password_Warn state.
Hope it makes sense!