Members

Prefix: /api/v1/users

See Overview for authentication.

List returns users in the caller's current organization when filterByOrg is true. Create, update, and delete use the standard-component routes and require ORG_ADMIN, SUPERADMIN, TENANTADMIN, or ROLE_SYSTEM.

Assigning a member to a department is an update: set orgUnitId to the department or team id from Departments. On create, pass orgUnitId in the body to set the department at the same time.

Endpoint summary

Method	Path
GET	`/users`
POST	`/users/standard-component`
PUT	`/users/standard-component/{id}`
DELETE	`/users/standard-component/{id}`

List members

GET /api/v1/users?page=0&size=10&search=&filterByOrg=true
Authorization: Bearer YOUR_API_TOKEN

Query	Default	Description
`page`	`0`	0-based page index
`size`	`10`	Page size
`sortBy`	`updatedAt`	User field to sort by
`direction`	`desc`	`asc` or `desc`
`search`		Search text. Omit or leave empty to return the page unfiltered
`filterByOrg`	`true`	When true, only users in the caller's current organization

Response 200 — Spring Page of users. Passwords are never returned. hasPassword and hasAvatar are booleans.

{
  "content": [
    {
      "id": "d34f51f4-d1d1-44c8-9df2-986b67838080",
      "userName": "ada",
      "email": "ada@example.com",
      "organizationId": "88888888-8888-8888-8888-888888888888",
      "organizationName": "Acme",
      "orgUnitId": "99999999-9999-9999-9999-999999999999",
      "active": true,
      "hasPassword": true,
      "hasAvatar": false,
      "directRoles": [
        { "id": "aaaaaaaa-0000-0000-0000-000000000001", "name": "MEMBER" }
      ],
      "organizationRoles": [
        {
          "organizationId": "88888888-8888-8888-8888-888888888888",
          "organizationName": "Acme",
          "roles": [{ "id": "aaaaaaaa-0000-0000-0000-000000000001", "name": "MEMBER" }]
        }
      ]
    }
  ],
  "totalElements": 1,
  "totalPages": 1,
  "size": 10,
  "number": 0,
  "first": true,
  "last": true,
  "empty": false
}

Create a member

POST /api/v1/users/standard-component
Content-Type: application/json
Authorization: Bearer YOUR_API_TOKEN

{
  "userName": "ada",
  "email": "ada@example.com",
  "roleId": "aaaaaaaa-0000-0000-0000-000000000001",
  "password": "optional-password",
  "orgUnitId": "99999999-9999-9999-9999-999999999999"
}

Creates a user with ORG_ADMIN or MEMBER in the caller's current organization. Organization is taken from the session; the client cannot choose a different org.

If an active user with the same email already exists in the portal and is not yet in the current organization, that user is linked into the org with the selected role instead of creating a second account.

Field	Required	Description
`userName`	yes	Display name
`email`	yes	Email address. Must be a valid email format
`roleId`	yes	Portal role UUID. The role must resolve to `ORG_ADMIN` or `MEMBER`
`password`	no	Optional password set at create time. Never returned in responses
`orgUnitId`	no	Department or team id from Departments

Response 201 — the created (or linked) user, same shape as a list row.

Update a member

PUT /api/v1/users/standard-component/d34f51f4-d1d1-44c8-9df2-986b67838080
Content-Type: application/json
Authorization: Bearer YOUR_API_TOKEN

{
  "userName": "ada",
  "roleId": "aaaaaaaa-0000-0000-0000-000000000001",
  "orgUnitId": "99999999-9999-9999-9999-999999999999"
}

Field	Required	Description
`userName`	no	Display name
`roleId`	yes	Portal role UUID. The role must resolve to `ORG_ADMIN` or `MEMBER`
`password`	no	Replacement password. Blank leaves the current password in place
`orgUnitId`	no	Department or team id. Ignored when `clearOrgUnit` is true
`clearOrgUnit`	no	When true, removes the member's department mapping

Organization membership cannot be changed on this route.

Response 200 — the updated user, same shape as a list row.

Response 409 when the update conflicts with the current membership:

{
  "status": 409,
  "error": "Conflict",
  "message": "..."
}

Delete a member

DELETE /api/v1/users/standard-component/3572f026-c798-4404-8404-b17614b79638
Authorization: Bearer YOUR_API_TOKEN

Removes the user from the caller's current organization. If the user still belongs to other organizations, only that membership is removed. Otherwise the account is soft-deleted.

Response 200

{
  "message": "User successfully deleted",
  "id": "3572f026-c798-4404-8404-b17614b79638"
}

Members

Members

Endpoint summary

List members

Create a member

Update a member

Delete a member

On this page