{ "info": { "_postman_id": "a9b9936c-498d-4022-a1cb-eccff62214bb", "name": "ThingsBoard Admin admin-controller auth-controller API", "description": "ThingsBoard Admin API \u2014 subset of the ThingsBoard REST API (open-source IoT platform). Covers: Admin, Audit Log, Event, Usage Info, Queue, Queue Stats, Mail Config Template, Qr Code Settings, Job.\n\nContact Support:\n Name: ThingsBoard team\n Email: info@thingsboard.io", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-07-28T03:12:05.000Z", "updatedAt": "2026-07-28T03:12:05.000Z", "lastUpdatedBy": "35240", "uid": "35240-a9b9936c-498d-4022-a1cb-eccff62214bb" }, "item": [ { "name": "api", "item": [ { "name": "noauth", "item": [ { "name": "resetPassword", "item": [ { "name": "Check Password Reset Token (checkResetToken)", "id": "23e2e74c-ccea-4ab9-8926-1ad3485c484b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/noauth/resetPassword?resetToken=", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "resetPassword" ], "query": [ { "description": "(Required) The reset token string.", "key": "resetToken", "value": "" } ] }, "description": "Checks the password reset token and forwards user to 'Reset Password' page. If token is valid, returns '303 See Other' (redirect) response code with the correct address of 'Reset Password' page and same 'resetToken' specified in the URL parameters. If token is not valid, returns '409 Conflict'. If token is expired, redirects to error page." }, "response": [ { "id": "dbda6ac3-f912-4975-b729-4b6356971456", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/noauth/resetPassword?resetToken=", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "resetPassword" ], "query": [ { "description": "(Required) The reset token string.", "key": "resetToken", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{}", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-dbda6ac3-f912-4975-b729-4b6356971456" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-23e2e74c-ccea-4ab9-8926-1ad3485c484b" }, { "name": "Reset Password (resetPassword)", "id": "fb3d6230-271e-4046-b7c8-5055c2331ad1", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"resetToken\": \"\",\n \"password\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/noauth/resetPassword", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "resetPassword" ] }, "description": "Checks the password reset token and updates the password. If token is not valid, returns '400 Bad Request'." }, "response": [ { "id": "fad23011-6554-4e99-b38e-fa3c31debf5a", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"resetToken\": \"\",\n \"password\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/noauth/resetPassword", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "resetPassword" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-fad23011-6554-4e99-b38e-fa3c31debf5a" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-fb3d6230-271e-4046-b7c8-5055c2331ad1" } ], "id": "351c75d6-87d4-40af-b792-80b99cf526f1", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-351c75d6-87d4-40af-b792-80b99cf526f1" }, { "name": "resetPasswordByEmail", "item": [ { "name": "Request Reset Password Email (requestResetPasswordByEmail)", "id": "4d350a58-4876-4792-94a7-568040b131d7", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"email\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/noauth/resetPasswordByEmail", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "resetPasswordByEmail" ] }, "description": "Request to send the reset password email if the user with specified email address is present in the database. Always return '200 OK' status for security purposes." }, "response": [ { "id": "3e982650-5198-4f5c-8d47-a288bc880394", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"email\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/noauth/resetPasswordByEmail", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "resetPasswordByEmail" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-3e982650-5198-4f5c-8d47-a288bc880394" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-4d350a58-4876-4792-94a7-568040b131d7" } ], "id": "99887818-4e2b-4698-91a9-09147b1878b6", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-99887818-4e2b-4698-91a9-09147b1878b6" }, { "name": "activate", "item": [ { "name": "Check Activate User Token (checkActivateToken)", "id": "60df84b4-98ce-46b9-9920-77a155fbf771", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/noauth/activate?activateToken=", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "activate" ], "query": [ { "description": "(Required) The activate token string.", "key": "activateToken", "value": "" } ] }, "description": "Checks the activation token and forwards user to 'Create Password' page. If token is valid, returns '303 See Other' (redirect) response code with the correct address of 'Create Password' page and same 'activateToken' specified in the URL parameters. If token is not valid, returns '409 Conflict'. If token is expired, redirects to error page." }, "response": [ { "id": "dd40e5a0-5abb-4cbd-8954-e1dc9c65d80f", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/noauth/activate?activateToken=", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "activate" ], "query": [ { "description": "(Required) The activate token string.", "key": "activateToken", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{}", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-dd40e5a0-5abb-4cbd-8954-e1dc9c65d80f" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-60df84b4-98ce-46b9-9920-77a155fbf771" }, { "name": "Activate User", "id": "5bc5f0f7-f3ea-4349-9966-e2c54522937a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"activateToken\": \"\",\n \"password\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/noauth/activate?sendActivationMail=true", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "activate" ], "query": [ { "key": "sendActivationMail", "value": "true" } ] }, "description": "Checks the activation token and updates corresponding user password in the database. Now the user may start using his password to login. The response already contains the [JWT](https://jwt.io) activation and refresh tokens, to simplify the user activation flow and avoid asking user to input password again after activation. If token is valid, returns the object that contains [JWT](https://jwt.io/) access and refresh tokens. If token is not valid, returns '400 Bad Request'." }, "response": [ { "id": "bcad27bf-4c95-4007-9336-e29be6a19ee1", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"activateToken\": \"\",\n \"password\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/noauth/activate?sendActivationMail=true", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "activate" ], "query": [ { "key": "sendActivationMail", "value": "true" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"token\": \"\",\n \"refreshToken\": \"\",\n \"scope\": \"TENANT_ADMIN\"\n}", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-bcad27bf-4c95-4007-9336-e29be6a19ee1" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-5bc5f0f7-f3ea-4349-9966-e2c54522937a" } ], "id": "d8cfe807-29bd-45ef-aedc-23e29c85cf69", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-d8cfe807-29bd-45ef-aedc-23e29c85cf69" }, { "name": "userPasswordPolicy", "item": [ { "name": "Get the Current User Password Policy (getUserPasswordPolicy)", "id": "dfaaaa1c-e59d-47a4-a219-fbdb30a2bb38", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/noauth/userPasswordPolicy", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "userPasswordPolicy" ] }, "description": "API call to get the password policy for the password validation form(s)." }, "response": [ { "id": "e65322f3-9afb-45e2-be87-c5492384dfae", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/noauth/userPasswordPolicy", "host": [ "{{baseUrl}}" ], "path": [ "api", "noauth", "userPasswordPolicy" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"minimumLength\": \"\",\n \"maximumLength\": \"\",\n \"minimumUppercaseLetters\": \"\",\n \"minimumLowercaseLetters\": \"\",\n \"minimumDigits\": \"\",\n \"minimumSpecialCharacters\": \"\",\n \"allowWhitespaces\": \"\",\n \"forceUserToResetPasswordIfNotValid\": \"\",\n \"passwordExpirationPeriodDays\": \"\",\n \"passwordReuseFrequencyDays\": \"\"\n}", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-e65322f3-9afb-45e2-be87-c5492384dfae" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-dfaaaa1c-e59d-47a4-a219-fbdb30a2bb38" } ], "id": "25f5cc89-ea51-4672-9e2f-cf1a3a107981", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-25f5cc89-ea51-4672-9e2f-cf1a3a107981" } ], "id": "cc5325ca-59a4-4ece-a37c-d6318bbb1193", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-cc5325ca-59a4-4ece-a37c-d6318bbb1193" }, { "name": "auth", "item": [ { "name": "logout", "item": [ { "name": "Logout (logout)", "id": "0173e3ae-bf05-49e7-922f-79e68f11604a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [], "url": { "raw": "{{baseUrl}}/api/auth/logout", "host": [ "{{baseUrl}}" ], "path": [ "api", "auth", "logout" ] }, "description": "Special API call to record the 'logout' of the user to the Audit Logs. Since platform uses [JWT](https://jwt.io/), the actual logout is the procedure of clearing the [JWT](https://jwt.io/) token on the client side. " }, "response": [ { "id": "72b397b2-527f-479f-ac26-a747a552e173", "name": "OK", "originalRequest": { "method": "POST", "header": [], "url": { "raw": "{{baseUrl}}/api/auth/logout", "host": [ "{{baseUrl}}" ], "path": [ "api", "auth", "logout" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-72b397b2-527f-479f-ac26-a747a552e173" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-0173e3ae-bf05-49e7-922f-79e68f11604a" } ], "id": "d0e2003a-f7e4-4867-9778-e80cf90f9028", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-d0e2003a-f7e4-4867-9778-e80cf90f9028" }, { "name": "changePassword", "item": [ { "name": "Change Password for Current User (changePassword)", "id": "6b496ae6-0f2a-4630-b6dc-4566af176c87", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"currentPassword\": \"\",\n \"newPassword\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/auth/changePassword", "host": [ "{{baseUrl}}" ], "path": [ "api", "auth", "changePassword" ] }, "description": "Change the password for the User which credentials are used to perform this REST API call. Be aware that previously generated [JWT](https://jwt.io/) tokens will be still valid until they expire." }, "response": [ { "id": "d7ddef9d-285d-4fab-8ca8-2554ecd50627", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"currentPassword\": \"\",\n \"newPassword\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/auth/changePassword", "host": [ "{{baseUrl}}" ], "path": [ "api", "auth", "changePassword" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"token\": \"\",\n \"refreshToken\": \"\",\n \"scope\": \"TENANT_ADMIN\"\n}", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-d7ddef9d-285d-4fab-8ca8-2554ecd50627" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-6b496ae6-0f2a-4630-b6dc-4566af176c87" } ], "id": "e98ac8e7-5609-49c9-a1e4-a5e7e79eddb3", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-e98ac8e7-5609-49c9-a1e4-a5e7e79eddb3" }, { "name": "user", "item": [ { "name": "Get Current User (getUser)", "id": "d6c9ce2a-a841-416d-b7e0-b1274846de82", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/auth/user", "host": [ "{{baseUrl}}" ], "path": [ "api", "auth", "user" ] }, "description": "Get the information about the User which credentials are used to perform this REST API call." }, "response": [ { "id": "66ae9cd5-4f4b-466b-98de-09f4768f9197", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/auth/user", "host": [ "{{baseUrl}}" ], "path": [ "api", "auth", "user" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"authority\": \"CUSTOMER_USER\",\n \"email\": \"\",\n \"id\": {\n \"entityType\": \"USER\",\n \"id\": \"\"\n },\n \"createdTime\": \"\",\n \"tenantId\": {\n \"entityType\": \"TENANT\",\n \"id\": \"\"\n },\n \"customerId\": {\n \"entityType\": \"CUSTOMER\",\n \"id\": \"\"\n },\n \"firstName\": \"\",\n \"lastName\": \"\",\n \"phone\": \"\",\n \"version\": \"\",\n \"name\": \"\",\n \"additionalInfo\": {\n \"description\": \"A value representing the any type (object or primitive)\",\n \"examples\": [\n {}\n ]\n }\n}", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-66ae9cd5-4f4b-466b-98de-09f4768f9197" } ], "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-d6c9ce2a-a841-416d-b7e0-b1274846de82" } ], "id": "abc1e4d1-a5fe-4feb-ae30-12f7f704ee18", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-abc1e4d1-a5fe-4feb-ae30-12f7f704ee18" } ], "id": "23f84f0b-ddb6-4f7d-8b57-49bd0797fed5", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-23f84f0b-ddb6-4f7d-8b57-49bd0797fed5" } ], "id": "80c2d910-506c-402f-965e-ff1c0a5e3365", "createdAt": "2026-07-28T03:12:06.000Z", "updatedAt": "2026-07-28T03:12:06.000Z", "uid": "35240-80c2d910-506c-402f-965e-ff1c0a5e3365" } ], "variable": [ { "key": "baseUrl", "value": "https://demo.thingsboard.io" } ] }