Skip to main content
The users functions are currently in BETA. The API may change without notice. A one-time warning is emitted on first use.

List Users

Results are sorted by creation date ascending (oldest first). Requires account admin role, member role, or USER_READ permission.

Create a User

Create a new account user with explicit invite control. Idempotent on email when inviteMode !== "none". Requires account admin role or USER_CREATE permission.

Invite Modes

Get a User

Requires account admin role, member role, or USER_READ permission.

Update a User

Update the display name and/or developer permission. At least one of name or isDeveloper must be provided. Requires account admin role or USER_UPDATE permission.

Delete a User

Permanently blocks the user from the account (sets status to INACTIVE, a terminal state). Cascades to organization memberships, space memberships, API keys, and role bindings. Blocked users cannot be re-invited. Callers cannot delete themselves. Requires account admin role or USER_DELETE permission.

Bulk Delete Users

Delete multiple users by ID and/or email. This is a client-side orchestration helper — it resolves each email to a user ID, then issues a DELETE for every resolved ID. Individual failures are returned in the result array rather than thrown, so callers can inspect which deletions succeeded. Requires account admin role or USER_DELETE permission.

Resend Invitation

Regenerate the verification token and resend the invitation email. The target user must be in the INVITED state. Returns 400 if the user has already verified their account or if SAML/IdP login is enforced. Requires account admin role or USER_CREATE permission.

Reset Password

Trigger a password-reset email for a user. Generates a reset token and sends an email with a 30-minute link. Returns 400 if the user authenticates via SSO/SAML or has not yet verified their account. Requires account admin role or USER_UPDATE permission.