File "/usr/local/lib/python3.6/site-packages/rest_framework/views.py", line 495, in dispatch
    response = self.handle_exception(exc)
  File "/usr/local/lib/python3.6/site-packages/rest_framework/views.py", line 455, in handle_exception
    self.raise_uncaught_exception(exc)
  File "/usr/local/lib/python3.6/site-packages/rest_framework/views.py", line 492, in dispatch
    response = handler(request, *args, **kwargs)
  File "./api/views.py", line 76, in patch
    return super().update(new_password, kwargs['pk'])
  File "/usr/local/lib/python3.6/site-packages/rest_framework/mixins.py", line 68, in update
    serializer = self.get_serializer(instance, data=request.data, partial=partial)
AttributeError: 'str' object has no attribute 'data'

class ChangePassView(generics.RetrieveUpdateAPIView):

    queryset = User.objects.filter.all()
    serializer_class = ChangePassSerializer

    def patch(self, request, *args, **kwargs):

        old_password = request.POST["old_password"]
        new_password = request.POST["new_password"]
        new_password_confirm = request.POST["new_password_confirm"]

        if new_password != (new_password_confirm):
             return JsonResponse({'message': '新しいパスワードが異なります'}, status=403)

        user = User.objects.get(id=kwargs['pk'])

        if not user.check_password(old_password):
             return JsonResponse({'message': '現在のパスワードが異なります'}, status=403)

        return super().update(new_password, kwargs['pk'])

class UpdateModelMixin(object):
    """
    Update a model instance.
    """
    def update(self, request, *args, **kwargs):
        partial = kwargs.pop('partial', False)
        instance = self.get_object()
        serializer = self.get_serializer(instance, data=request.data, partial=partial)
        serializer.is_valid(raise_exception=True)
        self.perform_update(serializer)

        if getattr(instance, '_prefetched_objects_cache', None):
            # If 'prefetch_related' has been applied to a queryset, we need to
            # forcibly invalidate the prefetch cache on the instance.
            instance._prefetched_objects_cache = {}

        return Response(serializer.data)

    def perform_update(self, serializer):
        serializer.save()

    def partial_update(self, request, *args, **kwargs):
        kwargs['partial'] = True
        return self.update(request, *args, **kwargs)

class User(AbstractBaseUser, PermissionsMixin):
    user_Id = models.CharField(_('user_Id'), max_length=7, unique=True)
    password = models.CharField(_('password'), max_length=255)

class ChangePassSerializer(serializers.ModelSerializer):

    old_password = serializers.CharField(max_length=255)
    new_password = serializers.CharField(max_length=255)
    new_password_confirm = serializers.CharField(max_length=255)

    class Meta:
        model = User
        fields = ('password',)

    def update(self, user, validated_data):
        user.set_password(validated_data['password'])
        user.save()
        return user

urlpatterns = [
  app_name = 'api'
  path('password_change/<int:pk>/', ChangePassView.as_view(),
        name='password_change'),
]