> For the complete documentation index, see [llms.txt](https://docs.truedat.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.truedat.io/v8.12/api-integrations/authentication-management/users.md).
# Users
## List users
> Returns every user known to the authorization service, including their role and group memberships.\
> \
> Requires an account with administrative privileges (\*\*administrator or service account\*\*).\
> \
> The list is not filtered by domain: administrators and service accounts see every user.\
> \
> Soft-deleted users are not returned.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users":{"get":{"description":"Returns every user known to the authorization service, including their role and group memberships.\n\nRequires an account with administrative privileges (**administrator or service account**).\n\nThe list is not filtered by domain: administrators and service accounts see every user.\n\nSoft-deleted users are not returned.\n","operationId":"TdAuthWeb.UserController.index","parameters":[],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserListResponse"}}},"description":"Users list"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"List users","tags":["Users"]}}},"components":{"schemas":{"UserListResponse":{"additionalProperties":false,"properties":{"data":{"items":{"$ref":"#/components/schemas/User"},"type":"array"}},"required":["data"],"title":"UserListResponse","type":"object"},"User":{"additionalProperties":true,"description":"Full user representation returned by show and mutation endpoints.","properties":{"acls":{"description":"Domain roles held by the user, either directly or through their groups. Present only in the `show` response.","items":{"$ref":"#/components/schemas/UserAclEntry"},"type":"array"},"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Names of the groups the user belongs to.","items":{"type":"string"},"type":"array"},"id":{"type":"integer"},"role":{"description":"High level role of the account (for example `admin`, `user`, `service`, `agent`).","nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"User","type":"object"},"UserAclEntry":{"additionalProperties":true,"description":"Domain role held by the user, either directly or through one of their groups.\n\nWhen the ACL is granted through a group, the `group` field is present. When granted directly to the user, `group` is absent.\n","properties":{"group":{"additionalProperties":true,"description":"Group through which the ACL is granted. Absent when the grant is direct.","nullable":true,"properties":{"alias":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"resource":{"$ref":"#/components/schemas/AclResource"},"role":{"$ref":"#/components/schemas/AclRole"}},"required":["resource","role"],"title":"UserAclEntry","type":"object"},"AclResource":{"additionalProperties":true,"description":"Resource the ACL applies to.","properties":{"id":{"type":"integer"},"name":{"nullable":true,"type":"string"},"type":{"description":"Resource type, for example `domain` or `structure`.","type":"string"}},"required":["id","type"],"title":"AclResource","type":"object"},"AclRole":{"additionalProperties":true,"description":"Role granted by the ACL entry.","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"AclRole","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Create user
> Creates a user with the supplied credentials and profile.\
> \
> Requires \*\*administrator\*\* access.\
> \
> The \`groups\` array is a list of \*\*group names\*\*. Groups that do not exist yet are created automatically as part of the same operation.\
> \
> The response includes a \`Location\` header pointing at the newly created user.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users":{"post":{"description":"Creates a user with the supplied credentials and profile.\n\nRequires **administrator** access.\n\nThe `groups` array is a list of **group names**. Groups that do not exist yet are created automatically as part of the same operation.\n\nThe response includes a `Location` header pointing at the newly created user.\n","operationId":"TdAuthWeb.UserController.create","parameters":[],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserCreateRequest"}}},"description":"User creation payload","required":false},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}},"description":"User created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnprocessableEntityChangesetResponse"}}},"description":"Unprocessable Entity"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Create user","tags":["Users"]}}},"components":{"schemas":{"UserCreateRequest":{"additionalProperties":false,"properties":{"user":{"additionalProperties":false,"properties":{"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Group names. Missing groups are created on the fly.","items":{"type":"string"},"nullable":true,"type":"array"},"password":{"format":"password","type":"string"},"role":{"description":"Defaults to `user` when omitted.","nullable":true,"type":"string"},"user_name":{"type":"string"}},"required":["user_name","password"],"type":"object"}},"required":["user"],"title":"UserCreateRequest","type":"object"},"UserResponse":{"additionalProperties":false,"properties":{"data":{"$ref":"#/components/schemas/User"}},"required":["data"],"title":"UserResponse","type":"object"},"User":{"additionalProperties":true,"description":"Full user representation returned by show and mutation endpoints.","properties":{"acls":{"description":"Domain roles held by the user, either directly or through their groups. Present only in the `show` response.","items":{"$ref":"#/components/schemas/UserAclEntry"},"type":"array"},"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Names of the groups the user belongs to.","items":{"type":"string"},"type":"array"},"id":{"type":"integer"},"role":{"description":"High level role of the account (for example `admin`, `user`, `service`, `agent`).","nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"User","type":"object"},"UserAclEntry":{"additionalProperties":true,"description":"Domain role held by the user, either directly or through one of their groups.\n\nWhen the ACL is granted through a group, the `group` field is present. When granted directly to the user, `group` is absent.\n","properties":{"group":{"additionalProperties":true,"description":"Group through which the ACL is granted. Absent when the grant is direct.","nullable":true,"properties":{"alias":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"resource":{"$ref":"#/components/schemas/AclResource"},"role":{"$ref":"#/components/schemas/AclRole"}},"required":["resource","role"],"title":"UserAclEntry","type":"object"},"AclResource":{"additionalProperties":true,"description":"Resource the ACL applies to.","properties":{"id":{"type":"integer"},"name":{"nullable":true,"type":"string"},"type":{"description":"Resource type, for example `domain` or `structure`.","type":"string"}},"required":["id","type"],"title":"AclResource","type":"object"},"AclRole":{"additionalProperties":true,"description":"Role granted by the ACL entry.","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"AclRole","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHUnprocessableEntityChangesetResponse":{"additionalProperties":false,"description":"Response emitted for Ecto.Changeset validation failures. Keys under `errors` are the invalid field names and values are lists of messages.","properties":{"errors":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"required":["errors"],"title":"AUTHUnprocessableEntityChangesetResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## List agent users
> Returns every user whose role is \`agent\`, including role and group memberships.\
> \
> Requires an account with administrative privileges (\*\*administrator or service account\*\*).
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users/agents":{"get":{"description":"Returns every user whose role is `agent`, including role and group memberships.\n\nRequires an account with administrative privileges (**administrator or service account**).\n","operationId":"TdAuthWeb.UserController.agents","parameters":[],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserListResponse"}}},"description":"Agent users list"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"List agent users","tags":["Users"]}}},"components":{"schemas":{"UserListResponse":{"additionalProperties":false,"properties":{"data":{"items":{"$ref":"#/components/schemas/User"},"type":"array"}},"required":["data"],"title":"UserListResponse","type":"object"},"User":{"additionalProperties":true,"description":"Full user representation returned by show and mutation endpoints.","properties":{"acls":{"description":"Domain roles held by the user, either directly or through their groups. Present only in the `show` response.","items":{"$ref":"#/components/schemas/UserAclEntry"},"type":"array"},"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Names of the groups the user belongs to.","items":{"type":"string"},"type":"array"},"id":{"type":"integer"},"role":{"description":"High level role of the account (for example `admin`, `user`, `service`, `agent`).","nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"User","type":"object"},"UserAclEntry":{"additionalProperties":true,"description":"Domain role held by the user, either directly or through one of their groups.\n\nWhen the ACL is granted through a group, the `group` field is present. When granted directly to the user, `group` is absent.\n","properties":{"group":{"additionalProperties":true,"description":"Group through which the ACL is granted. Absent when the grant is direct.","nullable":true,"properties":{"alias":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"resource":{"$ref":"#/components/schemas/AclResource"},"role":{"$ref":"#/components/schemas/AclRole"}},"required":["resource","role"],"title":"UserAclEntry","type":"object"},"AclResource":{"additionalProperties":true,"description":"Resource the ACL applies to.","properties":{"id":{"type":"integer"},"name":{"nullable":true,"type":"string"},"type":{"description":"Resource type, for example `domain` or `structure`.","type":"string"}},"required":["id","type"],"title":"AclResource","type":"object"},"AclRole":{"additionalProperties":true,"description":"Role granted by the ACL entry.","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"AclRole","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## List users and groups eligible for a foreign grant request
> Returns the users and groups that the caller is allowed to open a foreign grant request for, restricted to the domains supplied in \`structures\_domains\`.\
> \
> \*\*Permissions:\*\*\
> \- Administrator accounts always receive results.\
> \- Any other account must hold \*\*'View structures'\*\* in at least one domain and \*\*'Create grant request for third parties'\*\* in at least one domain. Missing either → \`403\`.\
> \- Independently, the caller must hold \*\*'Create grant request for third parties'\*\* on every domain listed in \`structures\_domains\`. Missing on any of them → \`200\` with empty \`data\` and \`groups\`.\
> \
> \*\*Filter location:\*\*\
> Filters may be supplied either in the JSON request body or as query parameters. If both are present, the query-string values take precedence on conflict.\
> \
> \*\*Behavior:\*\*\
> \- \`structures\_domains\` must contain at least one domain ID. If it is empty or absent, the endpoint responds with \`200\` and empty \`users\` and \`groups\` arrays.\
> \- The caller must be allowed to create foreign grant requests on \*\*every\*\* domain listed in \`structures\_domains\`. If the caller has the permission on some but not all of the domains, the endpoint responds with \`200\` and empty \`users\` and \`groups\` arrays. The response never reveals which domain caused the failure.\
> \- Users in \`data\` must hold \*\*'Allow grant requests from third parties'\*\* (\`allow\_foreign\_grant\_request\`) through a role on every domain in \`structures\_domains\`, or through the default role. Administrator accounts are listed only when they qualify the same way; the account type alone is not enough.\
> \- Groups in \`groups\` must hold \*\*'Allow grant request from third parties (at group level)'\*\* (\`allow\_only\_group\_foreign\_grant\_request\`) through a role assigned to the group on every domain in \`structures\_domains\`, or through the default role. A group holding only \`allow\_foreign\_grant\_request\` is not listed, although its members are. Assigning \`allow\_only\_group\_foreign\_grant\_request\` to an individual user has no effect.\
> \- \`filter\_domains\`, \`query\` and \`roles\` narrow the returned users and groups.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users/grant_requestable":{"post":{"description":"Returns the users and groups that the caller is allowed to open a foreign grant request for, restricted to the domains supplied in `structures_domains`.\n\n**Permissions:**\n- Administrator accounts always receive results.\n- Any other account must hold **'View structures'** in at least one domain and **'Create grant request for third parties'** in at least one domain. Missing either → `403`.\n- Independently, the caller must hold **'Create grant request for third parties'** on every domain listed in `structures_domains`. Missing on any of them → `200` with empty `data` and `groups`.\n\n**Filter location:**\nFilters may be supplied either in the JSON request body or as query parameters. If both are present, the query-string values take precedence on conflict.\n\n**Behavior:**\n- `structures_domains` must contain at least one domain ID. If it is empty or absent, the endpoint responds with `200` and empty `users` and `groups` arrays.\n- The caller must be allowed to create foreign grant requests on **every** domain listed in `structures_domains`. If the caller has the permission on some but not all of the domains, the endpoint responds with `200` and empty `users` and `groups` arrays. The response never reveals which domain caused the failure.\n- Users in `data` must hold **'Allow grant requests from third parties'** (`allow_foreign_grant_request`) through a role on every domain in `structures_domains`, or through the default role. Administrator accounts are listed only when they qualify the same way; the account type alone is not enough.\n- Groups in `groups` must hold **'Allow grant request from third parties (at group level)'** (`allow_only_group_foreign_grant_request`) through a role assigned to the group on every domain in `structures_domains`, or through the default role. A group holding only `allow_foreign_grant_request` is not listed, although its members are. Assigning `allow_only_group_foreign_grant_request` to an individual user has no effect.\n- `filter_domains`, `query` and `roles` narrow the returned users and groups.\n","operationId":"TdAuthWeb.UserSearchController.grant_requestable","parameters":[{"description":"Domain IDs the caller intends to open a grant request for. Required in practice: without it (or with an empty list) the endpoint returns empty `data` and `groups` arrays.","explode":true,"in":"query","name":"structures_domains","required":false,"schema":{"items":{"type":"integer"},"type":"array"},"style":"form"},{"description":"Optional domain filter applied to the returned users and groups. Does not affect the permission check.","explode":true,"in":"query","name":"filter_domains","required":false,"schema":{"items":{"type":"integer"},"type":"array"},"style":"form"},{"description":"Partial, case-insensitive match against a user full name, or against a group name or alias.","in":"query","name":"query","required":false,"schema":{"type":"string"}},{"description":"Restricts the returned users and groups to those holding at least one of the given role IDs.","explode":true,"in":"query","name":"roles","required":false,"schema":{"items":{"type":"integer"},"type":"array"},"style":"form"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantRequestableRequest"}}},"description":"Grant requestable filters","required":false},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantRequestableResponse"}}},"description":"Requestable users and groups"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"List users and groups eligible for a foreign grant request","tags":["Users"]}}},"components":{"schemas":{"GrantRequestableRequest":{"additionalProperties":false,"description":"Filters accepted by the grant-requestable endpoint. The endpoint returns the users and groups the caller can address when opening a foreign grant request on the supplied domains.","properties":{"filter_domains":{"description":"Optional domain filter applied to the returned users and groups. Does not affect the permission check, only the result set.","items":{"type":"integer"},"nullable":true,"type":"array"},"query":{"description":"Partial, case-insensitive match against a user full name, or against a group name or alias. An empty string is treated as no filter.","nullable":true,"type":"string"},"roles":{"description":"Restricts the returned users and groups to those holding at least one of the given role IDs. Role names are not accepted here; pass the numeric role identifier.","items":{"type":"integer"},"nullable":true,"type":"array"},"structures_domains":{"description":"Domain IDs the caller intends to open a grant request for. Required in practice: when absent or empty, the endpoint responds with 200 and empty `data` and `groups` arrays. The caller must be allowed to create foreign grant requests on every listed domain for the request to return data.","items":{"type":"integer"},"nullable":true,"type":"array"}},"title":"GrantRequestableRequest","type":"object"},"GrantRequestableResponse":{"additionalProperties":false,"description":"Users and groups the caller may open a foreign grant request for. Both lists are always present, even when empty, so clients can rely on a stable shape.","properties":{"data":{"description":"Eligible users. Empty when none of the users meet the permission check.","items":{"$ref":"#/components/schemas/User"},"type":"array"},"groups":{"description":"Eligible groups. Empty when no group holds the required permission on every requested domain.","items":{"$ref":"#/components/schemas/Group"},"type":"array"}},"required":["data","groups"],"title":"GrantRequestableResponse","type":"object"},"User":{"additionalProperties":true,"description":"Full user representation returned by show and mutation endpoints.","properties":{"acls":{"description":"Domain roles held by the user, either directly or through their groups. Present only in the `show` response.","items":{"$ref":"#/components/schemas/UserAclEntry"},"type":"array"},"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Names of the groups the user belongs to.","items":{"type":"string"},"type":"array"},"id":{"type":"integer"},"role":{"description":"High level role of the account (for example `admin`, `user`, `service`, `agent`).","nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"User","type":"object"},"UserAclEntry":{"additionalProperties":true,"description":"Domain role held by the user, either directly or through one of their groups.\n\nWhen the ACL is granted through a group, the `group` field is present. When granted directly to the user, `group` is absent.\n","properties":{"group":{"additionalProperties":true,"description":"Group through which the ACL is granted. Absent when the grant is direct.","nullable":true,"properties":{"alias":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"resource":{"$ref":"#/components/schemas/AclResource"},"role":{"$ref":"#/components/schemas/AclRole"}},"required":["resource","role"],"title":"UserAclEntry","type":"object"},"AclResource":{"additionalProperties":true,"description":"Resource the ACL applies to.","properties":{"id":{"type":"integer"},"name":{"nullable":true,"type":"string"},"type":{"description":"Resource type, for example `domain` or `structure`.","type":"string"}},"required":["id","type"],"title":"AclResource","type":"object"},"AclRole":{"additionalProperties":true,"description":"Role granted by the ACL entry.","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"AclRole","type":"object"},"Group":{"additionalProperties":false,"description":"Full group representation returned by the group management endpoints. When `users` is present, it lists the members of the group.","properties":{"alias":{"description":"Short, human readable alias used in listings.","nullable":true,"type":"string"},"description":{"nullable":true,"type":"string"},"id":{"description":"Unique group identifier.","type":"integer"},"name":{"description":"Group name. Unique across groups.","type":"string"},"users":{"description":"Members of the group. Present on list, show and update responses; may be absent on creation responses.","items":{"$ref":"#/components/schemas/UserEmbedded"},"type":"array"}},"required":["id","name"],"title":"Group","type":"object"},"UserEmbedded":{"additionalProperties":true,"description":"Compact user representation embedded inside an ACL entry.","properties":{"email":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"id":{"type":"integer"},"role":{"nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"UserEmbedded","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Search users
> Returns the users known to the authorization service that match the supplied filters, up to a configured maximum number of results. Further matches are silently truncated.\
> \
> \*\*Filter location:\*\*\
> Filters may be supplied either in the JSON request body or as query parameters. If both are present, the query-string values take precedence on conflict.\
> \
> \*\*Filter behavior:\*\*\
> \- \`query\` performs a partial, case-insensitive match against user name, full name and email.\
> \- \`domains\` restricts the result set to users holding at least one role in any of the supplied domain IDs. Domain IDs must be sent as strings even in JSON payloads.\
> \- \`roles\` restricts the result set to users holding at least one of the supplied role IDs.\
> \- \`permission\` restricts the result set to users holding the supplied permission. Its effect depends on how the permission is granted:\
> \- If the permission belongs to the default role, the domain filter is skipped and every user holding that permission is returned.\
> \- Otherwise, the result is restricted to the domains the caller can reach for that permission:\
> \- \`admin\` and \`service\` accounts reach every domain.\
> \- Regular accounts only produce results for \`allow\_foreign\_grant\_request\`, resolved against the domains where the caller may create foreign grant requests. Any other value yields an empty result.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users/search":{"post":{"description":"Returns the users known to the authorization service that match the supplied filters, up to a configured maximum number of results. Further matches are silently truncated.\n\n**Filter location:**\nFilters may be supplied either in the JSON request body or as query parameters. If both are present, the query-string values take precedence on conflict.\n\n**Filter behavior:**\n- `query` performs a partial, case-insensitive match against user name, full name and email.\n- `domains` restricts the result set to users holding at least one role in any of the supplied domain IDs. Domain IDs must be sent as strings even in JSON payloads.\n- `roles` restricts the result set to users holding at least one of the supplied role IDs.\n- `permission` restricts the result set to users holding the supplied permission. Its effect depends on how the permission is granted:\n - If the permission belongs to the default role, the domain filter is skipped and every user holding that permission is returned.\n - Otherwise, the result is restricted to the domains the caller can reach for that permission:\n - `admin` and `service` accounts reach every domain.\n - Regular accounts only produce results for `allow_foreign_grant_request`, resolved against the domains where the caller may create foreign grant requests. Any other value yields an empty result.\n","operationId":"TdAuthWeb.UserSearchController.create","parameters":[{"description":"Partial, case-insensitive match against user name, full name or email.","in":"query","name":"query","required":false,"schema":{"type":"string"}},{"description":"Comma-separated list of domain IDs, or repeated `domains[]=...` entries.","explode":false,"in":"query","name":"domains","required":false,"schema":{"items":{"type":"string"},"type":"array"},"style":"form"},{"description":"Comma-separated list of role IDs, or repeated `roles[]=...` entries.","explode":false,"in":"query","name":"roles","required":false,"schema":{"items":{"type":"integer"},"type":"array"},"style":"form"},{"description":"Permission name to filter users by.","in":"query","name":"permission","required":false,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserSearchRequest"}}},"description":"User search filters","required":false},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserSearchResponse"}}},"description":"Matching users"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Search users","tags":["Users"]}}},"components":{"schemas":{"UserSearchRequest":{"additionalProperties":false,"description":"Filters accepted by the user search endpoint. All filters are optional and combine with AND semantics. Results are truncated to the configured maximum number of users.","properties":{"domains":{"description":"Restricts the result set to users that hold at least one role in at least one of the given domain IDs. Domain IDs must be sent as strings even inside a JSON body ","items":{"type":"string"},"nullable":true,"type":"array"},"permission":{"description":"Restricts the result set to users holding the given permission on at least one domain reachable by the caller.\n\nToday only `allow_foreign_grant_request` produces results:\n- `admin` and `service` accounts resolve the set of every reachable domain.\n- `user` accounts resolve the domains where they themselves are allowed to create foreign grant requests.\n\nAny other value yields an empty reachable-domain set and therefore an empty result.\n","nullable":true,"type":"string"},"query":{"description":"Partial, case-insensitive match against the user name, full name or email. An empty string is treated as no filter.","nullable":true,"type":"string"},"roles":{"description":"Restricts the result set to users holding at least one of the given role IDs. Role IDs are numeric identifiers; role names are not accepted here.","items":{"type":"integer"},"nullable":true,"type":"array"}},"title":"UserSearchRequest","type":"object"},"UserSearchResponse":{"additionalProperties":false,"description":"Result of a user search. The list may be empty when no user matches the supplied filters or when the caller has no visibility on the requested domains.","properties":{"data":{"description":"Matching users.","items":{"$ref":"#/components/schemas/User"},"type":"array"}},"required":["data"],"title":"UserSearchResponse","type":"object"},"User":{"additionalProperties":true,"description":"Full user representation returned by show and mutation endpoints.","properties":{"acls":{"description":"Domain roles held by the user, either directly or through their groups. Present only in the `show` response.","items":{"$ref":"#/components/schemas/UserAclEntry"},"type":"array"},"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Names of the groups the user belongs to.","items":{"type":"string"},"type":"array"},"id":{"type":"integer"},"role":{"description":"High level role of the account (for example `admin`, `user`, `service`, `agent`).","nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"User","type":"object"},"UserAclEntry":{"additionalProperties":true,"description":"Domain role held by the user, either directly or through one of their groups.\n\nWhen the ACL is granted through a group, the `group` field is present. When granted directly to the user, `group` is absent.\n","properties":{"group":{"additionalProperties":true,"description":"Group through which the ACL is granted. Absent when the grant is direct.","nullable":true,"properties":{"alias":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"resource":{"$ref":"#/components/schemas/AclResource"},"role":{"$ref":"#/components/schemas/AclRole"}},"required":["resource","role"],"title":"UserAclEntry","type":"object"},"AclResource":{"additionalProperties":true,"description":"Resource the ACL applies to.","properties":{"id":{"type":"integer"},"name":{"nullable":true,"type":"string"},"type":{"description":"Resource type, for example `domain` or `structure`.","type":"string"}},"required":["id","type"],"title":"AclResource","type":"object"},"AclRole":{"additionalProperties":true,"description":"Role granted by the ACL entry.","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"AclRole","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Get user
> Returns the specified user together with the domain roles they hold, either directly or through their groups.\
> \
> Requires \*\*administrator\*\* access.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users/{id}":{"get":{"description":"Returns the specified user together with the domain roles they hold, either directly or through their groups.\n\nRequires **administrator** access.\n","operationId":"TdAuthWeb.UserController.show","parameters":[{"description":"User ID.","in":"path","name":"id","required":true,"schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}},"description":"User detail"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHNotFoundResponse"}}},"description":"Not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Get user","tags":["Users"]}}},"components":{"schemas":{"UserResponse":{"additionalProperties":false,"properties":{"data":{"$ref":"#/components/schemas/User"}},"required":["data"],"title":"UserResponse","type":"object"},"User":{"additionalProperties":true,"description":"Full user representation returned by show and mutation endpoints.","properties":{"acls":{"description":"Domain roles held by the user, either directly or through their groups. Present only in the `show` response.","items":{"$ref":"#/components/schemas/UserAclEntry"},"type":"array"},"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Names of the groups the user belongs to.","items":{"type":"string"},"type":"array"},"id":{"type":"integer"},"role":{"description":"High level role of the account (for example `admin`, `user`, `service`, `agent`).","nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"User","type":"object"},"UserAclEntry":{"additionalProperties":true,"description":"Domain role held by the user, either directly or through one of their groups.\n\nWhen the ACL is granted through a group, the `group` field is present. When granted directly to the user, `group` is absent.\n","properties":{"group":{"additionalProperties":true,"description":"Group through which the ACL is granted. Absent when the grant is direct.","nullable":true,"properties":{"alias":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"resource":{"$ref":"#/components/schemas/AclResource"},"role":{"$ref":"#/components/schemas/AclRole"}},"required":["resource","role"],"title":"UserAclEntry","type":"object"},"AclResource":{"additionalProperties":true,"description":"Resource the ACL applies to.","properties":{"id":{"type":"integer"},"name":{"nullable":true,"type":"string"},"type":{"description":"Resource type, for example `domain` or `structure`.","type":"string"}},"required":["id","type"],"title":"AclResource","type":"object"},"AclRole":{"additionalProperties":true,"description":"Role granted by the ACL entry.","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"AclRole","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHNotFoundResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHNotFoundResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Update user
> Updates the user profile fields supplied in the request body.\
> \
> Requires \*\*administrator\*\* access, \*\*or\*\* the caller must be \*\*the target user\*\* themselves.\
> \
> If the payload contains a \`password\` field, the request is rejected with \`403\` and no field is updated. Password changes are handled through a dedicated flow, not this endpoint.\
> \
> The \`groups\` array is a list of group names. Groups that do not exist yet are created automatically.\
> \
> The endpoint accepts partial updates: fields not present in the payload are left untouched.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users/{id}":{"put":{"description":"Updates the user profile fields supplied in the request body.\n\nRequires **administrator** access, **or** the caller must be **the target user** themselves.\n\nIf the payload contains a `password` field, the request is rejected with `403` and no field is updated. Password changes are handled through a dedicated flow, not this endpoint.\n\nThe `groups` array is a list of group names. Groups that do not exist yet are created automatically.\n\nThe endpoint accepts partial updates: fields not present in the payload are left untouched.\n","operationId":"TdAuthWeb.UserController.update","parameters":[{"description":"User ID.","in":"path","name":"id","required":true,"schema":{"type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserUpdateRequest"}}},"description":"User update payload","required":false},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}},"description":"User updated"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHNotFoundResponse"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnprocessableEntityChangesetResponse"}}},"description":"Unprocessable Entity"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Update user","tags":["Users"]}}},"components":{"schemas":{"UserUpdateRequest":{"additionalProperties":false,"description":"Update payload. The `password` field is deliberately **not accepted here**: sending it forces a `403` response regardless of any other field.","properties":{"user":{"additionalProperties":false,"properties":{"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"items":{"type":"string"},"nullable":true,"type":"array"},"role":{"nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"type":"object"}},"required":["user"],"title":"UserUpdateRequest","type":"object"},"UserResponse":{"additionalProperties":false,"properties":{"data":{"$ref":"#/components/schemas/User"}},"required":["data"],"title":"UserResponse","type":"object"},"User":{"additionalProperties":true,"description":"Full user representation returned by show and mutation endpoints.","properties":{"acls":{"description":"Domain roles held by the user, either directly or through their groups. Present only in the `show` response.","items":{"$ref":"#/components/schemas/UserAclEntry"},"type":"array"},"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Names of the groups the user belongs to.","items":{"type":"string"},"type":"array"},"id":{"type":"integer"},"role":{"description":"High level role of the account (for example `admin`, `user`, `service`, `agent`).","nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"User","type":"object"},"UserAclEntry":{"additionalProperties":true,"description":"Domain role held by the user, either directly or through one of their groups.\n\nWhen the ACL is granted through a group, the `group` field is present. When granted directly to the user, `group` is absent.\n","properties":{"group":{"additionalProperties":true,"description":"Group through which the ACL is granted. Absent when the grant is direct.","nullable":true,"properties":{"alias":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"resource":{"$ref":"#/components/schemas/AclResource"},"role":{"$ref":"#/components/schemas/AclRole"}},"required":["resource","role"],"title":"UserAclEntry","type":"object"},"AclResource":{"additionalProperties":true,"description":"Resource the ACL applies to.","properties":{"id":{"type":"integer"},"name":{"nullable":true,"type":"string"},"type":{"description":"Resource type, for example `domain` or `structure`.","type":"string"}},"required":["id","type"],"title":"AclResource","type":"object"},"AclRole":{"additionalProperties":true,"description":"Role granted by the ACL entry.","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"AclRole","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHNotFoundResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHNotFoundResponse","type":"object"},"AUTHUnprocessableEntityChangesetResponse":{"additionalProperties":false,"description":"Response emitted for Ecto.Changeset validation failures. Keys under `errors` are the invalid field names and values are lists of messages.","properties":{"errors":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"required":["errors"],"title":"AUTHUnprocessableEntityChangesetResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Delete user
> Permanently deletes the specified user.\
> \
> Requires \*\*administrator\*\* access.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users/{id}":{"delete":{"description":"Permanently deletes the specified user.\n\nRequires **administrator** access.\n","operationId":"TdAuthWeb.UserController.delete","parameters":[{"description":"User ID.","in":"path","name":"id","required":true,"schema":{"type":"integer"}}],"responses":{"204":{"description":"User deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHNotFoundResponse"}}},"description":"Not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Delete user","tags":["Users"]}}},"components":{"schemas":{"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHNotFoundResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHNotFoundResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Update user
> Updates the user profile fields supplied in the request body.\
> \
> Requires \*\*administrator\*\* access, \*\*or\*\* the caller must be \*\*the target user\*\* themselves.\
> \
> If the payload contains a \`password\` field, the request is rejected with \`403\` and no field is updated. Password changes are handled through a dedicated flow, not this endpoint.\
> \
> The \`groups\` array is a list of group names. Groups that do not exist yet are created automatically.\
> \
> The endpoint accepts partial updates: fields not present in the payload are left untouched.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/users/{id}":{"patch":{"description":"Updates the user profile fields supplied in the request body.\n\nRequires **administrator** access, **or** the caller must be **the target user** themselves.\n\nIf the payload contains a `password` field, the request is rejected with `403` and no field is updated. Password changes are handled through a dedicated flow, not this endpoint.\n\nThe `groups` array is a list of group names. Groups that do not exist yet are created automatically.\n\nThe endpoint accepts partial updates: fields not present in the payload are left untouched.\n","operationId":"TdAuthWeb.UserController.update (2)","parameters":[{"description":"User ID.","in":"path","name":"id","required":true,"schema":{"type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserUpdateRequest"}}},"description":"User update payload","required":false},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}},"description":"User updated"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHNotFoundResponse"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnprocessableEntityChangesetResponse"}}},"description":"Unprocessable Entity"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Update user","tags":["Users"]}}},"components":{"schemas":{"UserUpdateRequest":{"additionalProperties":false,"description":"Update payload. The `password` field is deliberately **not accepted here**: sending it forces a `403` response regardless of any other field.","properties":{"user":{"additionalProperties":false,"properties":{"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"items":{"type":"string"},"nullable":true,"type":"array"},"role":{"nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"type":"object"}},"required":["user"],"title":"UserUpdateRequest","type":"object"},"UserResponse":{"additionalProperties":false,"properties":{"data":{"$ref":"#/components/schemas/User"}},"required":["data"],"title":"UserResponse","type":"object"},"User":{"additionalProperties":true,"description":"Full user representation returned by show and mutation endpoints.","properties":{"acls":{"description":"Domain roles held by the user, either directly or through their groups. Present only in the `show` response.","items":{"$ref":"#/components/schemas/UserAclEntry"},"type":"array"},"email":{"nullable":true,"type":"string"},"external_id":{"nullable":true,"type":"string"},"full_name":{"nullable":true,"type":"string"},"groups":{"description":"Names of the groups the user belongs to.","items":{"type":"string"},"type":"array"},"id":{"type":"integer"},"role":{"description":"High level role of the account (for example `admin`, `user`, `service`, `agent`).","nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"User","type":"object"},"UserAclEntry":{"additionalProperties":true,"description":"Domain role held by the user, either directly or through one of their groups.\n\nWhen the ACL is granted through a group, the `group` field is present. When granted directly to the user, `group` is absent.\n","properties":{"group":{"additionalProperties":true,"description":"Group through which the ACL is granted. Absent when the grant is direct.","nullable":true,"properties":{"alias":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"resource":{"$ref":"#/components/schemas/AclResource"},"role":{"$ref":"#/components/schemas/AclRole"}},"required":["resource","role"],"title":"UserAclEntry","type":"object"},"AclResource":{"additionalProperties":true,"description":"Resource the ACL applies to.","properties":{"id":{"type":"integer"},"name":{"nullable":true,"type":"string"},"type":{"description":"Resource type, for example `domain` or `structure`.","type":"string"}},"required":["id","type"],"title":"AclResource","type":"object"},"AclRole":{"additionalProperties":true,"description":"Role granted by the ACL entry.","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"AclRole","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHNotFoundResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHNotFoundResponse","type":"object"},"AUTHUnprocessableEntityChangesetResponse":{"additionalProperties":false,"description":"Response emitted for Ecto.Changeset validation failures. Keys under `errors` are the invalid field names and values are lists of messages.","properties":{"errors":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"required":["errors"],"title":"AUTHUnprocessableEntityChangesetResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```