I think you misread this expression? Or am i being dumb? The intended logic is to only return the password if it is a generated password. It won't return the password if it is one you manually provided to the API.

The thinking was to minimize leaking a password that you have chosen manually - but i'm more than happy to remove the ``if`` guard.