Hi Paul,
Indeed it is. Here's a curl example for doing it after the fact:
curl '$XNAT_URL/xapi/users/$TARGET_USER' -X PUT -H 'Content-Type: application/json' --data-raw '{"username":"$TARGET_USER","password":"$TARGET_PASSWORD"}'
And here's a curl example for creating a new [enabled, verified] account as an admin [which includes setting initial password]:
curl '$XNAT_URL/xapi/users' -H 'Content-Type: application/json' --data-raw '{"username":"$USERNAME","password":"$PASSWORD","firstName":"$FIRST","lastName":"$LAST","email":"$EMAIL","verified":true,"enabled":true}'
Thanks,
Charlie Moore