{
  "opencollection": "1.0.0",
  "info": {
    "name": "Logto API references Account center Users API",
    "version": "Cloud"
  },
  "request": {
    "auth": {
      "type": "oauth2",
      "flow": "client_credentials",
      "accessTokenUrl": "/oidc/token",
      "credentials": {
        "clientId": "{{clientId}}",
        "clientSecret": "{{clientSecret}}"
      }
    }
  },
  "items": [
    {
      "info": {
        "name": "Users",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Get user",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "includeSsoIdentities",
                "value": "",
                "type": "query",
                "description": "If it's provided with a truthy value (`true`, `1`, `yes`), each user in the response will include a `ssoIdentities` property containing a list of SSO identities associated with the user."
              },
              {
                "name": "includePasswordHash",
                "value": "",
                "type": "query",
                "description": "If it's provided with a truthy value (`true`, `1`, `yes`), the response will include the `passwordDigest` and `passwordAlgorithm` fields. These fields are omitted by default for security reasons."
              }
            ]
          },
          "docs": "Get user data for the given ID."
        },
        {
          "info": {
            "name": "Update user",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://[tenant_id].logto.app/api/users/:userId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update user data for the given ID. This method performs a partial update."
        },
        {
          "info": {
            "name": "Delete user",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://[tenant_id].logto.app/api/users/:userId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ]
          },
          "docs": "Delete user with the given ID. Note all associated data will be deleted cascadingly."
        },
        {
          "info": {
            "name": "Get user custom data",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/custom-data",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ]
          },
          "docs": "Get custom data for the given user ID."
        },
        {
          "info": {
            "name": "Update user custom data",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://[tenant_id].logto.app/api/users/:userId/custom-data",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update custom data for the given user ID. This method performs a partial update of the custom data object."
        },
        {
          "info": {
            "name": "Get user logto config",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/logto-configs",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ]
          },
          "docs": "Retrieve the exposed portion of a user's logto config. Includes MFA states (enabled, skipped, skipMfaOnSignIn) and passkey sign-in states (skipped)."
        },
        {
          "info": {
            "name": "Update user logto config",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://[tenant_id].logto.app/api/users/:userId/logto-configs",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update the exposed portion of a user's logto config. Supports updating MFA states (enabled, skipped, skipMfaOnSignIn) and passkey sign-in states (skipped). All fields are optional — only provided fields will be updated."
        },
        {
          "info": {
            "name": "Update user profile",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://[tenant_id].logto.app/api/users/:userId/profile",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update profile for the given user ID. This method performs a partial update of the profile object."
        },
        {
          "info": {
            "name": "Get users",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Page number (starts from 1)."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Entries per page."
              },
              {
                "name": "search_params",
                "value": "",
                "type": "query",
                "description": "Search query parameters."
              }
            ]
          },
          "docs": "Get users with filters and pagination.\n\nLogto provides a very flexible way to query users. You can filter users by almost any fields with multiple modes. To learn more about the query syntax, please refer to [Advanced user search](https://docs.logto.io/docs/recipes/manage-users/advanced-user-search/)."
        },
        {
          "info": {
            "name": "Create user",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/users",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create a new user with the given data."
        },
        {
          "info": {
            "name": "Update user password",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://[tenant_id].logto.app/api/users/:userId/password",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update user password for the given ID."
        },
        {
          "info": {
            "name": "Verify user password",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/users/:userId/password/verify",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Test if the given password matches the user's password."
        },
        {
          "info": {
            "name": "Check if user has password",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/has-password",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ]
          },
          "docs": "Check if the user with the given ID has a password set."
        },
        {
          "info": {
            "name": "Update user suspension status",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://[tenant_id].logto.app/api/users/:userId/is-suspended",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update user suspension status for the given ID."
        },
        {
          "info": {
            "name": "Get roles for user",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/roles",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Page number (starts from 1)."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Entries per page."
              },
              {
                "name": "search_params",
                "value": "",
                "type": "query",
                "description": "Search query parameters."
              }
            ]
          },
          "docs": "Get API resource roles assigned to the user with pagination."
        },
        {
          "info": {
            "name": "Assign roles to user",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/users/:userId/roles",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Assign API resource roles to the user. The roles will be added to the existing roles."
        },
        {
          "info": {
            "name": "Update roles for user",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://[tenant_id].logto.app/api/users/:userId/roles",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update API resource roles assigned to the user. This will replace the existing roles."
        },
        {
          "info": {
            "name": "Remove role from user",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://[tenant_id].logto.app/api/users/:userId/roles/:roleId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "roleId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the role."
              }
            ]
          },
          "docs": "Remove an API resource role from the user."
        },
        {
          "info": {
            "name": "Retrieve a user's social identity and associated token storage .",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/identities/:target",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "target",
                "value": "",
                "type": "path"
              },
              {
                "name": "includeTokenSecret",
                "value": "",
                "type": "query",
                "description": "Whether to include the token secret in the response. Defaults to false. Token storage must be supported and enabled by the connector to return the token secret."
              }
            ]
          },
          "docs": "This API retrieves the social identity and its associated token set for the specified user from the Logto Secret Vault. The token set will only be available if token storage is enabled for the corresponding social connector."
        },
        {
          "info": {
            "name": "Update social identity of user",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://[tenant_id].logto.app/api/users/:userId/identities/:target",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "target",
                "value": "",
                "type": "path"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Directly update a social identity of the user."
        },
        {
          "info": {
            "name": "Delete social identity from user",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://[tenant_id].logto.app/api/users/:userId/identities/:target",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "target",
                "value": "",
                "type": "path"
              }
            ]
          },
          "docs": "Delete a social identity from the user."
        },
        {
          "info": {
            "name": "Link social identity to user",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/users/:userId/identities",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Link authenticated user identity from a social platform to a Logto user.\n\nThe usage of this API is usually coupled with `POST /connectors/:connectorId/authorization-uri`. With the help of these pair of APIs, you can implement a user profile page with the link social account feature in your application.\n\nNote: Currently due to technical limitations, this API does not support the following connectors that rely on Logto interaction session: `@logto/connector-apple`, `@logto/connector-saml`, `@logto"
        },
        {
          "info": {
            "name": "Get organizations for a user",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/organizations",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ]
          },
          "docs": "Get all organizations that the user is a member of. In each organization object, the user's roles in that organization are included in the `organizationRoles` array."
        },
        {
          "info": {
            "name": "Get user active grants",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/grants",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "appType",
                "value": "",
                "type": "query",
                "description": "Application type filter. Use 'thirdParty' to list third-party app grants only, or 'firstParty' to list first-party app grants only. If omitted, grants from all applications are returned."
              }
            ]
          },
          "docs": "Retrieve all non-expired grants of the user. Optionally filter by application type via `appType`; when omitted, grants from all application types are returned."
        },
        {
          "info": {
            "name": "Revoke a user grant",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://[tenant_id].logto.app/api/users/:userId/grants/:grantId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "grantId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the grant."
              }
            ]
          },
          "docs": "Revoke a specific grant and its associated token chain by grant ID. Also removes the matching session authorization entry for this grant from the related active session. The grant must belong to the user."
        },
        {
          "info": {
            "name": "Get user's MFA verifications",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/mfa-verifications",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ]
          },
          "docs": "Get a user's existing MFA verifications for a given user ID."
        },
        {
          "info": {
            "name": "Create an MFA verification for a user",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/users/:userId/mfa-verifications",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create a new MFA verification for a given user ID."
        },
        {
          "info": {
            "name": "Delete an MFA verification for a user",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://[tenant_id].logto.app/api/users/:userId/mfa-verifications/:verificationId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "verificationId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the verification."
              }
            ]
          },
          "docs": "Delete an MFA verification for the user with the given verification ID. The verification ID must be associated with the given user ID."
        },
        {
          "info": {
            "name": "Get personal access tokens",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/personal-access-tokens",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ]
          },
          "docs": "Get all personal access tokens for the user."
        },
        {
          "info": {
            "name": "Add personal access token",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/users/:userId/personal-access-tokens",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Add a new personal access token for the user."
        },
        {
          "info": {
            "name": "Update personal access token",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://[tenant_id].logto.app/api/users/:userId/personal-access-tokens",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update a token for the user by name."
        },
        {
          "info": {
            "name": "Update personal access token",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://[tenant_id].logto.app/api/users/:userId/personal-access-tokens/:name",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "name",
                "value": "",
                "type": "path",
                "description": "The current name of the token."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update a token for the user by name using the legacy path parameter. Deprecated: use the PATCH /personal-access-tokens endpoint instead to avoid url name encoding issues."
        },
        {
          "info": {
            "name": "Delete personal access token",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://[tenant_id].logto.app/api/users/:userId/personal-access-tokens/:name",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "name",
                "value": "",
                "type": "path",
                "description": "The name of the token."
              }
            ]
          },
          "docs": "Delete a token for the user by name using the legacy path parameter. Deprecated: use the POST /delete endpoint instead to avoid url name encoding issues."
        },
        {
          "info": {
            "name": "Delete personal access token",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/users/:userId/personal-access-tokens/delete",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Delete a token for the user by name."
        },
        {
          "info": {
            "name": "Retrieve a user's enterprise SSO identity and associated token secret (if token storage is enabled).",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/sso-identities/:ssoConnectorId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "ssoConnectorId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the sso connector."
              },
              {
                "name": "includeTokenSecret",
                "value": "",
                "type": "query",
                "description": "Whether to include the token secret in the response. Defaults to false. Token storage must be supported and enabled by the connector to return the token secret."
              }
            ]
          },
          "docs": "This API retrieves the user's enterprise SSO identity and associated token set record from the Logto Secret Vault. The token set will only be available if token storage is enabled for the corresponding SSO connector."
        },
        {
          "info": {
            "name": "Retrieve social identities, enterprise SSO identities and associated token secret (if token storage is enabled) for a user.",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/all-identities",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "includeTokenSecret",
                "value": "",
                "type": "query",
                "description": "Whether to include the token secret in the response. Defaults to false. Token storage must be supported and enabled by the connector to return the token secret."
              }
            ]
          },
          "docs": "This API retrieves all identities (social and enterprise SSO) for a user, along with their associated token set records from the Logto Secret Vault. The token sets will only be available if token storage is enabled for the corresponding identity connector."
        },
        {
          "info": {
            "name": "Get user active sessions",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/sessions",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              }
            ]
          },
          "docs": "Retrieve all non-expired sessions for the user, including session metadata and interaction details when available."
        },
        {
          "info": {
            "name": "Get user active session",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/users/:userId/sessions/:sessionId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "sessionId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the session."
              }
            ]
          },
          "docs": "Retrieve a non-expired session for the user by session ID, including session metadata and interaction details when available."
        },
        {
          "info": {
            "name": "Revoke a user session",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://[tenant_id].logto.app/api/users/:userId/sessions/:sessionId",
            "params": [
              {
                "name": "userId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the user."
              },
              {
                "name": "sessionId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the session."
              },
              {
                "name": "revokeGrantsTarget",
                "value": "",
                "type": "query",
                "description": "Optional target for revoking associated grants and tokens. 'all' revokes grants for every application authorized by this session. 'firstParty' revokes only first-party app grants; third-party app grants remain active. If omitted, grants remain active when the session authorizations include offline_access; otherwise they are revoked."
              }
            ]
          },
          "docs": "Revoke a specific user session by its ID, optionally revoking associated target grants and tokens."
        }
      ]
    }
  ],
  "bundled": true
}