1Fort Business User API

openapi: 3.2.0
info:
  title: 1Fort API Documentation Business User API
  description: '# 1Fort API


    REST API for the 1Fort insurance platform. This document is the authoritative

    map of the API surface; endpoints are grouped in the sidebar by **app** and

    **version**, and large apps are split into per-resource sub-groups.


    ## Authentication


    Almost every endpoint requires a **JWT access token**. Send it in the

    `Authorization` header as either `Bearer <token>` or `JWT <token>`. Tokens may

    also be presented as an HTTP-only cookie. Endpoints documented with no security

    requirement are intentionally public (for example sign-in, OTP and storefront

    endpoints).


    ## Multi-tenancy


    Resources are scoped to a tenant. Nested routes carry the owning resource id in

    the path (for example `/v2/broker/{business_pk}/applications`); a token is only

    authorised for the businesses its user may access. Object-level permissions are

    enforced per endpoint.


    ## Versioning


    `v2` endpoints live under `/apis/v2/...` and are the current surface. `v1`

    endpoints remain documented for compatibility. Endpoints marked **deprecated**

    are scheduled for removal; prefer the documented replacement.

    '
  termsOfService: https://www.1fort.com/
  license:
    name: Privately owned
  version: v1
servers:
- url: https://api.1fort.com/apis/
security:
- Bearer: []
tags:
- name: business-user
  x-displayName: User
  description: '**Access:** requires a JWT access token.'
paths:
  /business-employee-type-permission:
    parameters: []
    get:
      operationId: business-employee-type-permission_list
      summary: Get Employee Type Permissions
      description: '

        Get the list of permissions for an employee type. If an employee type is not returned in the response, it means that it has no permissions.


        **Permissions:** ADMIN, SUPER_ADMIN

        '
      parameters:
      - name: search
        in: query
        description: A search term.
        required: false
        schema:
          type: string
      - name: ordering
        in: query
        description: Which field to use when ordering the results.
        required: false
        schema:
          type: string
      - name: limit
        in: query
        description: Number of results to return per page.
        required: false
        schema:
          type: integer
      - name: offset
        in: query
        description: The initial index from which to return the results.
        required: false
        schema:
          type: integer
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                required:
                - count
                - results
                type: object
                properties:
                  count:
                    type: integer
                  next:
                    type:
                    - string
                    - 'null'
                    format: uri
                  previous:
                    type:
                    - string
                    - 'null'
                    format: uri
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/BusinessEmployeeTypePermission'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '500':
          description: Internal server error.
      tags:
      - business-user
    post:
      operationId: business-employee-type-permission_create
      summary: Create Employee Type Permission
      description: '

        Create an employee type permission.


        **Permissions:** SUPER_ADMIN, ADMIN

        '
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessEmployeeTypePermission'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BusinessEmployeeTypePermission'
        required: true
  /business-employee-type-permission/{id}:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business employee type permission.
      required: true
      schema:
        type: integer
    get:
      operationId: business-employee-type-permission_read
      summary: Get Employee Type Permission
      description: '

        Get an employee type permission.


        **Permissions:** SUPER_ADMIN, ADMIN

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessEmployeeTypePermission'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
    patch:
      operationId: business-employee-type-permission_partial_update
      summary: Update Employee Type Permission
      description: '

        Update an employee type permission.


        **Permissions:** SUPER_ADMIN, ADMIN

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessEmployeeTypePermission'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BusinessEmployeeTypePermission'
        required: true
    delete:
      operationId: business-employee-type-permission_delete
      summary: Delete Employee Type Permission
      description: '

        Delete an employee type permission.


        **Permissions:** SUPER_ADMIN, ADMIN

        '
      responses:
        '204':
          description: ''
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
  /business-group:
    parameters: []
    get:
      operationId: business-group_list
      summary: Get Groups
      description: '

        Get the business user groups.


        **Permissions:** `can_manage_user_groups`

        '
      parameters:
      - name: search
        in: query
        description: A search term.
        required: false
        schema:
          type: string
      - name: limit
        in: query
        description: Number of results to return per page.
        required: false
        schema:
          type: integer
      - name: offset
        in: query
        description: The initial index from which to return the results.
        required: false
        schema:
          type: integer
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                required:
                - count
                - results
                type: object
                properties:
                  count:
                    type: integer
                  next:
                    type:
                    - string
                    - 'null'
                    format: uri
                  previous:
                    type:
                    - string
                    - 'null'
                    format: uri
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/BusinessGroup'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '500':
          description: Internal server error.
      tags:
      - business-user
    post:
      operationId: business-group_create
      summary: Create Group
      description: '

        Create a group.


        **Permissions:** `can_manage_user_groups`

        '
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessGroup'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BusinessGroup'
        required: true
  /business-group/{id}:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business group.
      required: true
      schema:
        type: integer
    get:
      operationId: business-group_read
      summary: Get Group Details
      description: '

        Get details of a group.


        **Permissions:** ADMIN, SUPER_ADMIN

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessGroup'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
    patch:
      operationId: business-group_partial_update
      summary: Update Group
      description: '

        Update a group.


        **Permissions:** ADMIN, SUPER_ADMIN

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessGroup'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BusinessGroup'
        required: true
    delete:
      operationId: business-group_delete
      summary: Delete Group
      description: '

        Delete a group.


        **Permissions:** ADMIN, SUPER_ADMIN

        '
      responses:
        '204':
          description: ''
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
  /business-group/{id}/add-users:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business group.
      required: true
      schema:
        type: integer
    post:
      operationId: business-group_add_users
      summary: Add Users to Group
      description: '

        Add users to a group.


        **Permissions:** `can_manage_user_groups`

        '
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessGroup'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BusinessGroup'
        required: true
  /business-group/{id}/get-users:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business group.
      required: true
      schema:
        type: integer
    get:
      operationId: business-group_get_users
      summary: Get Group Users
      description: '

        Get the list of users in a group.


        **Permissions:** ADMIN, SUPER_ADMIN

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessGroup'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
  /business-group/{id}/remove-users:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business group.
      required: true
      schema:
        type: integer
    post:
      operationId: business-group_remove_users
      summary: Remove Users from Group
      description: '

        Remove users from a group.


        **Permissions:** `can_manage_user_groups`

        '
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessGroup'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BusinessGroup'
        required: true
  /business-user:
    parameters: []
    get:
      operationId: business-user_list
      summary: Get Business Users
      description: '

        Get the list of all the users in the logged in user''s business.


        **Permissions:** ADMIN, SUPER_ADMIN

        '
      parameters:
      - name: search
        in: query
        description: A search term.
        required: false
        schema:
          type: string
      - name: user__status
        in: query
        description: user__status
        required: false
        schema:
          type: string
          enum:
          - Not Invited
          - Invited
          - Active
          - Removed
      - name: employee_type
        in: query
        description: employee_type
        required: false
        schema:
          type: string
          enum:
          - employee
          - contractor
          - non_employee
          - auditor
          - soc2
          - it_security
          - other
      - name: is_administrator
        in: query
        description: is_administrator
        required: false
        schema:
          type: string
      - name: role
        in: query
        description: role
        required: false
        schema:
          type: string
          enum:
          - admin
          - super_admin
          - user
          - one_fort_maintainer
          - auditor
      - name: limit
        in: query
        description: Number of results to return per page.
        required: false
        schema:
          type: integer
      - name: offset
        in: query
        description: The initial index from which to return the results.
        required: false
        schema:
          type: integer
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                required:
                - count
                - results
                type: object
                properties:
                  count:
                    type: integer
                  next:
                    type:
                    - string
                    - 'null'
                    format: uri
                  previous:
                    type:
                    - string
                    - 'null'
                    format: uri
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/BusinessUser'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '500':
          description: Internal server error.
      tags:
      - business-user
  /business-user/my-businesses:
    parameters: []
    get:
      operationId: business-user_my-businesses_list
      summary: List my businesses
      description: '

        Return every business the authenticated user is a member of, along with

        their role in each. Powers the client portal business switcher for users

        who belong to more than one business.

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MyBusinessListResponse'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '500':
          description: Internal server error.
      tags:
      - business-user
  /business-user/{id}:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business user.
      required: true
      schema:
        type: integer
    get:
      operationId: business-user_read
      summary: Get Business User Details
      description: '

        Get details of a user.


        `/me` endpoint can be used to get details of the logged in user, where the `id` is `me`.

        For `/me` endpoint, the `can_manage_users` permission is not required. Logged in users can get details of themselves.


        **Permissions:** ADMIN, SUPER_ADMIN, or me

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessUser'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
    patch:
      operationId: business-user_partial_update
      summary: Get Business User Details
      description: '

        Get details of a user.


        `/me` endpoint can be used to update details of the logged in user, where the `id` is `me`.

        For `/me` endpoint, the `can_manage_users` permission is not required. Logged in users can update basic details of themselves.


        **Permissions:** ADMIN, SUPER_ADMIN, or me

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessUser'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BusinessUser'
        required: true
  /business-user/{id}/access-role:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business user.
      required: true
      schema:
        type: integer
    post:
      operationId: business-user_set_access_role
      summary: Add access role
      description: '

        Set access role for users. The {id} of the users is required in the request body.

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessUser'
        '400':
          description: Bad request
          content:
            application/json:
              example:
                access_role:
                - Access role is required
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                access_role:
                  description: Access role
                  type: string
        required: true
  /business-user/{id}/groups:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business user.
      required: true
      schema:
        type: integer
    post:
      operationId: business-user_set_user_groups
      summary: Set user groups
      description: '

        Update the groups of a user.


        **Permissions:** `can_manage_user_groups`

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessUser'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                group_ids:
                  description: Group ids
                  type: array
                  items:
                    type: integer
        required: true
  /business-user/{id}/send-invitation-reminder:
    parameters:
    - name: id
      in: path
      description: A unique integer value identifying this business user.
      required: true
      schema:
        type: integer
    get:
      operationId: business-user_send_invitation_reminder
      summary: Send invitation reminder
      description: '

        Send an invitation reminder to a user.


        **Permissions:** SUPER_ADMIN, ADMIN

        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessUser'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '404':
          description: Object does not exist or caller has insufficient permissions to access it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIException'
        '500':
          description: Internal server error.
      tags:
      - business-user
  /custom-access-role:
    parameters: []
    get:
      operationId: custom-access-role_list
      summary: Get Custom Access Roles
      description: '

        Get all the Custom Access Roles for the Business.


        **Permissions:** `can_manage_access_roles`

        '
      parameters:
      - name: search
        in: query
        description: A search term.
        required: false
        schema:
          type: string
      - name: ordering
        in: query
        description: Which field to use when ordering the results.
        required: false
        schema:
          type: string
      - name: limit
        in: query
        description: Number of results to return per page.
        required: false
        schema:
          type: integer
      - name: offset
        in: query
        description: The initial index from which to return the results.
        required: false
        schema:
          type: integer
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                required:
                - count
                - results
                type: object
                properties:
                  count:
                    type: integer
                  next:
                    type:
                    - string
                    - 'null'
                    format: uri
                  previous:
                    type:
                    - string
                    - 'null'
                    format: uri
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/BusinessAccessRole'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '500':
          description: Internal server error.
      tags:
      - business-user
    post:
      operationId: custom-access-role_create
      summary: Create Custom Access Role
      description: '

        Create a Custom Access Role for the Business.

        You can get the list of all the permissions from the `GET /custom-access-roles/permissions` endpoint.


        **Permissions:** `can_manage_access_roles`

        '
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessAccessRole'
        '400':
          description: Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: Authentication credentials were invalid, absent or insufficient.
          content:
       

# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/1fort/refs/heads/main/openapi/1fort-business-user-api-openapi.yml