openapi: 3.2.0 info: title: Lawmatics OAuth Users API version: 1.22.0 description: 'The official Lawmatics REST API for legal CRM, client intake and law firm automation. Manage matters (prospects), contacts, companies, custom forms and form entries, custom fields, events and appointments, tasks, notes, files, tags, users, time entries, expenses, invoices and transactions. Authentication is OAuth 2.0 authorization code grant; access tokens do not expire, there are no refresh tokens, and Lawmatics does not currently support scopes - an authorized app receives full CRUD access to the granted account. All list endpoints support the shared query-parameter grammar documented in the Param Guide: `fields` (field selection, one level deep, `fields=all` to expand), `page` (pagination), `sort_by`/`sort_order`, and `filter_by`/`filter_on`/`filter_with` (one filter at a time; operators `=`, `!=`, `<=`, `<`, `>=`, `>`, `like`, `ilike`, `null`, `not_null`). Responses follow a JSON:API-style `data` / `attributes` / `relationships` envelope.' contact: name: Lawmatics API Support email: api@lawmatics.com url: https://docs.lawmatics.com/ termsOfService: https://www.lawmatics.com/terms-of-use servers: - url: https://api.lawmatics.com description: Lawmatics production API security: - oauth2: [] - bearerAuth: [] tags: - name: Users paths: /v1/users/{user_id}: get: operationId: getUser summary: User description: Return a specific User by ID tags: - Users parameters: - name: user_id in: path required: true description: The user id schema: type: string responses: '200': description: OK content: application/json: schema: type: object examples: getUser: summary: GET User value: data: id: '17' type: user attributes: name: Roey Chasman email: roey@lawmatics.com role: admin sign_in_count: 80 profile_pic_url: https://lm.lawmatics.com/attachments/bb05ebb95548440709cfee67eaa47ad9477901f7/store/7a1dfa6208de277097e5fd94cef73878adce3ec6010ef99611a30a209607/photo.gif created_at: '2018-01-05T17:19:17.216-08:00' updated_at: '2018-10-16T10:11:52.023-07:00' relationships: firms: data: - id: '15' type: firm - id: '24' type: firm current_firm: data: id: '15' type: firm invited_by: data: id: '15' type: user '401': description: Unauthorized - missing or invalid OAuth 2.0 bearer token '429': description: Too Many Requests - the per-firm rate limit was exceeded; a Retry-After header is returned headers: Retry-After: description: Seconds to wait before retrying schema: type: integer put: operationId: updateUser summary: Update User description: Updates a user tags: - Users parameters: - name: user_id in: path required: true description: The user id schema: type: string requestBody: required: true content: application/json: schema: type: object example: first_name: Bruce last_name: Banner email: thebat.ef46a23a-0525-4977-ba30-fa146d7c1816@gothan.com responses: default: description: Example response captured in the source Postman collection; the HTTP status code was not recorded by the publisher. content: application/json: schema: type: object examples: putUpdateUser: summary: PUT Update User value: data: id: '28' type: user attributes: first_name: Bruce last_name: Banner email: thebat@gothan.com created_at: '2022-10-31T16:11:06.048-07:00' updated_at: '2022-10-31T16:15:17.930-07:00' confirmed_at: null current_sign_in_at: null invitation_sent_at: null invitation_accepted_at: null role: Admin relationships: {} '401': description: Unauthorized - missing or invalid OAuth 2.0 bearer token '429': description: Too Many Requests - the per-firm rate limit was exceeded; a Retry-After header is returned headers: Retry-After: description: Seconds to wait before retrying schema: type: integer delete: operationId: deleteUser summary: Delete User description: Dissociates a user from a firm, in practice this is the same as deleting the user as it won't have access to the system anymore. tags: - Users parameters: - name: user_id in: path required: true description: The user id schema: type: string responses: '200': description: OK content: application/json: schema: type: object examples: deleteDeleteUser: summary: DELETE Delete User value: data: id: '17' type: user attributes: name: Roey Chasman email: roey@lawmatics.com role: admin sign_in_count: 80 profile_pic_url: https://lm.lawmatics.com/attachments/bb05ebb95548440709cfee67eaa47ad9477901f7/store/7a1dfa6208de277097e5fd94cef73878adce3ec6010ef99611a30a209607/photo.gif created_at: '2018-01-05T17:19:17.216-08:00' updated_at: '2018-10-16T10:11:52.023-07:00' relationships: firms: data: - id: '15' type: firm - id: '24' type: firm current_firm: data: id: '15' type: firm invited_by: data: id: '15' type: user '401': description: Unauthorized - missing or invalid OAuth 2.0 bearer token '429': description: Too Many Requests - the per-firm rate limit was exceeded; a Retry-After header is returned headers: Retry-After: description: Seconds to wait before retrying schema: type: integer /v1/users: get: operationId: getUsers summary: Users description: Return a paginated list of all users in the firm tags: - Users responses: '200': description: OK content: application/json: schema: type: object examples: getUsers: summary: GET Users value: data: - id: '219' type: user attributes: name: Bobby Orozco email: bobby@lawmatics.com created_at: '2018-09-10T14:54:02.100-07:00' updated_at: '2018-10-15T16:03:57.819-07:00' relationships: {} - id: '192' type: user attributes: name: Anna Gasperlin email: anna@lawmatics.com created_at: '2018-08-27T12:41:56.353-07:00' updated_at: '2018-10-16T16:19:21.578-07:00' relationships: {} - id: '66' type: user attributes: name: Jasper Forest email: jasper@lawmatics.com created_at: '2018-06-18T10:26:37.122-07:00' updated_at: '2018-10-02T19:56:32.119-07:00' relationships: {} - id: '24' type: user attributes: name: Fred Assuncao email: fred@lawmatics.com created_at: '2018-03-08T07:33:41.086-08:00' updated_at: '2018-10-16T12:58:29.738-07:00' relationships: {} - id: '23' type: user attributes: name: Sarah Bottorff email: sarah.bottorff@gmail.com created_at: '2018-03-06T06:21:09.994-08:00' updated_at: '2018-04-26T15:16:25.524-07:00' relationships: {} - id: '21' type: user attributes: name: Zsolt Már email: zsolt@lawmatics.com created_at: '2018-02-02T15:17:22.830-08:00' updated_at: '2018-10-12T17:36:54.846-07:00' relationships: {} - id: '17' type: user attributes: name: Roey Chasman email: roey@lawmatics.com created_at: '2018-01-05T17:19:17.216-08:00' updated_at: '2018-10-16T10:11:52.023-07:00' relationships: {} - id: '15' type: user attributes: name: Matt Spiegel email: matt@lawmatics.com created_at: '2018-01-05T09:20:40.371-08:00' updated_at: '2018-10-16T16:29:25.480-07:00' relationships: {} meta: total_pages: 1 limit_per_page: 25 total_entries: 8 links: self: /v1/user?page=1 '401': description: Unauthorized - missing or invalid OAuth 2.0 bearer token '429': description: Too Many Requests - the per-firm rate limit was exceeded; a Retry-After header is returned headers: Retry-After: description: Seconds to wait before retrying schema: type: integer post: operationId: createUser summary: Create User description: Creates a user or assigns it to the firm if it already exists. tags: - Users requestBody: required: true content: application/json: schema: type: object example: email: peter@oscorp.com role: Admin password: spiderman first_name: Peter last_name: Parker responses: default: description: Example response captured in the source Postman collection; the HTTP status code was not recorded by the publisher. content: application/json: schema: type: object examples: postCreateUser: summary: POST Create User value: data: id: '28' type: user attributes: first_name: Peter last_name: Parker email: peter@oscorp.com created_at: '2022-10-31T16:11:06.048-07:00' updated_at: '2022-10-31T16:11:06.048-07:00' confirmed_at: null current_sign_in_at: null invitation_sent_at: null invitation_accepted_at: null role: Admin relationships: {} '401': description: Unauthorized - missing or invalid OAuth 2.0 bearer token '429': description: Too Many Requests - the per-firm rate limit was exceeded; a Retry-After header is returned headers: Retry-After: description: Seconds to wait before retrying schema: type: integer /v1/users/me: get: operationId: getMe summary: Me description: Return the authenticated user tags: - Users responses: '200': description: OK content: application/json: schema: type: object examples: getMe: summary: GET Me value: data: id: '17' type: user attributes: name: Roey Chasman email: roey@lawmatics.com created_at: '2018-01-05T17:19:17.216-08:00' updated_at: '2018-10-16T10:11:52.023-07:00' relationships: {} '401': description: Unauthorized - missing or invalid OAuth 2.0 bearer token '429': description: Too Many Requests - the per-firm rate limit was exceeded; a Retry-After header is returned headers: Retry-After: description: Seconds to wait before retrying schema: type: integer components: securitySchemes: oauth2: type: oauth2 description: OAuth 2.0 authorization code grant. Register a developer app at https://app.lawmatics.com/settings/developers (developer settings must be enabled by Lawmatics support). Access tokens are non-expiring; no refresh tokens are issued and scopes are not supported. flows: authorizationCode: authorizationUrl: https://app.lawmatics.com/oauth/authorize tokenUrl: https://api.lawmatics.com/oauth/token scopes: {} bearerAuth: type: http scheme: bearer description: 'The OAuth 2.0 access token is sent as `Authorization: Bearer `.' externalDocs: description: Official Lawmatics RESTful API documentation (Postman) url: https://docs.lawmatics.com/ x-provenance: generated: '2026-08-13' method: derived publisher: API Evangelist source: https://docs.lawmatics.com/api/collections/26379991/2sA3JM7gbw?segregateAuth=true&versionTag=latest source_type: Postman collection published by Lawmatics as its official API documentation source_file: postman/lawmatics-oauth-api.postman_collection.json note: 'NOT published by Lawmatics. Lawmatics publishes no OpenAPI. Every path, method, parameter, request example and response example in this document was converted mechanically from the provider-published Postman collection "Lawmatics OAuth API v1.22.0"; nothing was invented. Schemas are typed as generic objects because the collection carries examples, not JSON Schema. The server URL is the base documented in the collection Param Guide (https://api.lawmatics.com), not the collection''s disabled {{host}} placeholder. The 401 and 429 responses added to every authenticated operation are the provider-documented, globally applicable responses: the collection''s auth guide states a per-firm rate limit applies to all endpoints and returns 429 with a Retry-After header, and https://api.lawmatics.com/v1/contacts was observed returning 401 unauthenticated on 2026-08-13.'