Users

Tenant user management — CRUD plus lifecycle (suspend/reactivate/soft-delete), metadata, sessions/force-logout, unlock, password-reset-on-behalf, and risk-state (SSO-1884).

Base URL: https://api.stg.thoryn.org

Operations

Method	Path	Summary	Scopes
GET	/api/v1/users	Users List	tenant:users.read
POST	/api/v1/users	Users Create	tenant:users.write
GET	/api/v1/users/locked	Users List Locked	tenant:users.read
GET	/api/v1/users/sessions	Users List Tenant Sessions	tenant:users.read
GET	/api/v1/users/{userId}	Users Get	tenant:users.read
PATCH	/api/v1/users/{userId}	Users Update	tenant:users.write
DELETE	/api/v1/users/{userId}	Users Delete	tenant:users.write
GET	/api/v1/users/{userId}/linked-identities	Users List Linked Identities	tenant:users.read
GET	/api/v1/users/{userId}/metadata	Users Get Metadata	tenant:users.read
PATCH	/api/v1/users/{userId}/metadata/app	Users Patch App Metadata	tenant:users.write
PATCH	/api/v1/users/{userId}/metadata/user	Users Patch User Metadata	tenant:users.write
GET	/api/v1/users/{userId}/organizations	Users List Organizations	tenant:users.read
POST	/api/v1/users/{userId}/password-reset	Users Password Reset	tenant:users.write
POST	/api/v1/users/{userId}/reactivate	Users Reactivate	tenant:users.write
GET	/api/v1/users/{userId}/risk-state	Users Get Risk State	tenant:users.read
PATCH	/api/v1/users/{userId}/risk-state	Users Set Risk State	tenant:users.write
GET	/api/v1/users/{userId}/sessions	Users List Sessions	tenant:users.read
DELETE	/api/v1/users/{userId}/sessions	Users Revoke All Sessions	tenant:users.write
DELETE	/api/v1/users/{userId}/sessions/{sessionId}	Users Revoke Session	tenant:users.write
POST	/api/v1/users/{userId}/suspend	Users Suspend	tenant:users.write
POST	/api/v1/users/{userId}/unlock	Users Unlock	tenant:users.write

Operation details

GET /api/v1/users

Users List

• Operation ID: usersList
• Required scopes: tenant:users.read

Parameters:

Name	In	Required	Type	Description
limit	query	no	integer
cursor	query	no	string
email	query	no	string
status	query	no	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/users

Users Create

• Operation ID: usersCreate
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
mode	query	no	string
Idempotency-Key	header	no	string

Request body (required): application/json → CreateUserRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/users/locked

Users List Locked

• Operation ID: usersListLocked
• Required scopes: tenant:users.read

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/users/sessions

Users List Tenant Sessions

• Operation ID: usersListTenantSessions
• Required scopes: tenant:users.read

Parameters:

Name	In	Required	Type	Description
limit	query	no	integer

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/users/{userId}

Users Get

• Operation ID: usersGet
• Required scopes: tenant:users.read

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

PATCH /api/v1/users/{userId}

Users Update

• Operation ID: usersUpdate
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Request body (required): application/json → UpdateUserRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

DELETE /api/v1/users/{userId}

Users Delete

• Operation ID: usersDelete
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/users/{userId}/linked-identities

Users List Linked Identities

• Operation ID: usersListLinkedIdentities
• Required scopes: tenant:users.read

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/users/{userId}/metadata

Users Get Metadata

• Operation ID: usersGetMetadata
• Required scopes: tenant:users.read

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

PATCH /api/v1/users/{userId}/metadata/app

Users Patch App Metadata

• Operation ID: usersPatchAppMetadata
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Request body (required): application/json → JsonNode

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

PATCH /api/v1/users/{userId}/metadata/user

Users Patch User Metadata

• Operation ID: usersPatchUserMetadata
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Request body (required): application/json → JsonNode

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/users/{userId}/organizations

Users List Organizations

• Operation ID: usersListOrganizations
• Required scopes: tenant:users.read

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/users/{userId}/password-reset

Users Password Reset

• Operation ID: usersPasswordReset
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/users/{userId}/reactivate

Users Reactivate

• Operation ID: usersReactivate
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/users/{userId}/risk-state

Users Get Risk State

• Operation ID: usersGetRiskState
• Required scopes: tenant:users.read

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

PATCH /api/v1/users/{userId}/risk-state

Users Set Risk State

• Operation ID: usersSetRiskState
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Request body (required): application/json → SetRiskStateRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/users/{userId}/sessions

Users List Sessions

• Operation ID: usersListSessions
• Required scopes: tenant:users.read

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

DELETE /api/v1/users/{userId}/sessions

Users Revoke All Sessions

• Operation ID: usersRevokeAllSessions
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

DELETE /api/v1/users/{userId}/sessions/{sessionId}

Users Revoke Session

• Operation ID: usersRevokeSession
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string
sessionId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/users/{userId}/suspend

Users Suspend

• Operation ID: usersSuspend
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/users/{userId}/unlock

Users Unlock

• Operation ID: usersUnlock
• Required scopes: tenant:users.write

Parameters:

Name	In	Required	Type	Description
userId	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)