Users
The people in a tenant, the roles they hold, and what those roles add up to.
Mirror an identity-provider user into the tenant
Adds a user to this tenant from your identity provider. The body carries only the provider's user id — email and display name are read from the provider itself, so a caller can never create a user under an identity they do not control. Repeating the call returns the existing user rather than creating a second one. Requires `user.create`.
List users
Returns the tenant's users, paginated. Requires `user.read`.
Get the calling user
Returns the account behind the current request. Use it to show who is signed in without knowing their id. Requires `me.read`.
Update the calling user
Changes the current user's own profile fields. Requires `user.update`.
Delete the calling user
Soft-deletes the current user's own account. Requires `user.delete`.
List the calling user's roles
Returns the roles the current user holds, both directly and through groups. Requires `me.read`.
List the calling user's groups
Returns the groups the current user belongs to, as mirrored from the identity provider. Requires `me.read`.
List the calling user's effective permissions
Returns the permission codes the current user actually holds — the union of every role, direct or inherited from a group. This is what the platform evaluates on each request, so it is the authoritative answer to what this account can do. Requires `me.read`.
Get a user
Returns one user. A user in another tenant is reported as not found rather than forbidden, because tenants cannot observe each other. Requires `user.read`.
Update a user
Changes a user's status or profile fields. Locking a user takes effect on their next request, not when their token expires. A user cannot lock or de-role themselves — only another administrator can, which is what stops a tenant locking itself out. Requires `user.update`.
Delete a user
Soft-deletes a user, who can be restored. Requires `user.delete`.
Restore a deleted user
Reinstates a soft-deleted user together with the roles and group memberships they held. Requires `user.restore`.
Get a user's effective permissions
Returns everything the user can actually do — the union of their direct roles and the roles they inherit from their groups. This is the answer to 'why can this person see that?'. Requires `user.read.effective-permissions`.
Assign a role to a user
Grants a user a role, optionally until a given date so temporary access expires on its own. Takes effect immediately. You cannot grant yourself a role. Requires `user.role.assign`.
List a user's roles
Returns the roles assigned to a user directly, not those inherited from groups — ask for effective permissions to see the full picture. Requires `user.role.read`.
Revoke a role from a user
Removes a role from a user, effective on their next request. You cannot revoke a role from yourself, so the last administrator cannot lock the tenant out of user management. Requires `user.role.revoke`.
List a user's groups
Returns the groups a user belongs to, which is where roles granted to a whole team come from. Requires `user.group.read`.