Users

This endpoint is primarily used for manipulating the currently logged on user. Administrators have broader access, e.g. for creating users.

Get current user

GET /api/user

Get the currently logged on user.

Get specific user

GET /api/user/{userId}

Scope: ADMIN or DATA_MANAGER

Request

Path parameters

• userId ID of the user

Response

A JSON object representing the user.

Update user

PUT /api/user

Update a user. Non-admin users can only update their own user. Admins can update any user.

Request

A JSON object with the properties to update.

Create user

POST /api/user

Scope: ADMIN

Create a new user, or update an existing one if the ID already exists.

Request

Body

{
    "id": string,
    "email": string,
    "newPassword": string,              // optional
    "sendConfirmationEmail": boolean    // optional
}

Response

The created or updated user object.

Get active tokens

GET /api/user/token

Get all active refresh tokens for the currently logged in user.

Response

[{
    "id": number,
    "ip": string,
    "userAgent": string,
    "token": string,
    "lastUsedUtc": string,
    "expireUtc": string
}]

Revoke token

DELETE /api/user/token/{tokenId}

Revoke a specific refresh token for the currently logged in user.

Request

Path parameters

• tokenId Numeric ID of the token

Get data scope

GET /api/user/data-scope

Get the current data scope (active department filter) for the logged in user.

Set data scope

POST /api/user/data-scope

Set the data scope (active department filter) for the logged in user.

Request

Body

{
    "departmentID": string
}

Change password

POST /api/user/password/change

Change the password for the currently logged on user.

Request

{
    "password": string,        // new password
    "repeatPassword": string,  // repeated new password
    "currentPassword": string  // current password
}

Forgot password

POST /api/user/password/forgot

Anonymous. Send a password reset email to the user.

Request

{
    "userId": string
}

Reset password

POST /api/user/password/reset

Anonymous. Reset password using the code from the forgot-password email.

Request

{
    "userId": string,
    "code": string,
    "password": string,
    "repeatPassword": string
}

Response

{
    "email": string,
    "expired": boolean  // only set if the reset link has expired
}

Confirm account

POST /api/user/confirm

Anonymous. Confirm a new user account using the code from the confirmation email.

Request

{
    "userId": string,
    "code": string
}

Response

{
    "newPasswordCode": string  // code to use for setting the initial password
}