User API
The User object is Trivore ID's central resource — every namespace, group, role, and
authorisation ultimately relates to it. This page gives an overview of the API's core
operations and points to where each related area is documented in more detail. The full,
authoritative list of endpoints is always the /apidoc/management/#/Users reference on your
own instance.
See User fields for details on individual fields in the User document, and User API examples for example requests.
Core operations
The base /api/rest/v1/user and /api/rest/v1/user/{userId} endpoints cover standard CRUD,
plus a couple of variations:
| Operation | Endpoint | Notes |
|---|---|---|
| List users | GET /user | Lists users from all namespaces the caller can access. Supports filtering and sorting by sortBy/sortOrder. |
| Search users | POST /user/search | An alternative to listing: filter parameters are given in the request body instead of a query string. Returns at most 500 users per call. |
| Create user | POST /user | Created in the caller's own namespace, unless another accessible namespace is specified. Minimum required fields depend on namespace configuration. |
| Get user | GET /user/{userId} | |
| Modify user | PUT /user/{userId} | Given fields overwrite existing values; fields left out of the request body are unchanged. |
| Partially update user | PATCH /user/{userId} | Applies a JSON Patch, for a limited set of fields. Some fields require additional permissions beyond the base modify permission — see the endpoint's own documentation for the full list. |
| Delete user | DELETE /user/{userId} |
Most operations require the caller — a signed-in user or a Management API Client — to have
access to the target user's namespace, plus a matching permission (ACCOUNT_FIND,
ACCOUNT_NEW, ACCOUNT_EDIT, or ACCOUNT_REMOVE). Some user information may be hidden from
the response unless the caller has additional, more specific permissions.
Related APIs
The User document itself only covers identity and core account data. A number of related, more specialized APIs act on or alongside a user account:
- Custom fields — freely-defined data attached to a user account. See Custom Fields, and the wider comparison of persistence options in Application Data Persistence and Sharing.
- Tokens — access-controlled key-value pairs attached to a user account. See User Tokens.
- Contact information changes — changing a user's email address or mobile number through a verify-before-committing flow. See Implementing changing of user's email address or mobile number.
- Security — password management, account locking, and multi-factor authentication. See Password Reset, Locking Accounts, and Multi-Factor Authentication.
- Groups, roles, and permissions — group membership plus built-in and custom roles. See Groups and Roles.
- GDPR and personal data — self-service data access and Personal Data Requests. See GDPR.
- Authorisations — a user account can be the Principal or Delegate of an Authorisation created through the Management API. See Authorisations.