openapi: 3.0.0
info:
title: Auth0 Authentication actions users API
description: Auth0 Authentication API. Endpoints for authentication and authorization using OpenID Connect, OAuth 2.0, SAML, WS-Federation, and Passwordless flows.
version: 1.0.0
servers:
- url: '{auth0_domain}'
description: The Authentication API is served over HTTPS.
variables:
auth0_domain:
description: Auth0 domain
default: https://demo.us.auth0.com
tags:
- name: users
paths:
/users:
get:
summary: List or Search Users
description: "Retrieve details of users. It is possible to:\n\n- Specify a search criteria for users\n- Sort the users to be returned\n- Select the fields to be returned\n- Specify the number of users to retrieve per page and the page index\n <!-- only v3 is available -->\nThe <code>q</code> query parameter can be used to get users that match the specified criteria <a href=\"https://auth0.com/docs/users/search/v3/query-syntax\">using query string syntax.</a>\n\n<a href=\"https://auth0.com/docs/users/search/v3\">Learn more about searching for users.</a>\n\nRead about <a href=\"https://auth0.com/docs/users/search/best-practices\">best practices</a> when working with the API endpoints for retrieving users.\n\nAuth0 limits the number of users you can return. If you exceed this threshold, please redefine your search, use the <a href=\"https://auth0.com/docs/api/management/v2#!/Jobs/post_users_exports\">export job</a>, or the <a href=\"https://auth0.com/docs/extensions/user-import-export\">User Import / Export</a> extension.\n"
tags:
- users
parameters:
- name: page
in: query
description: Page index of the results to return. First page is 0.
schema:
type: integer
minimum: 0
- name: per_page
in: query
description: Number of results per page.
schema:
type: integer
minimum: 0
maximum: 100
- name: include_totals
in: query
description: Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
schema:
type: boolean
- name: sort
in: query
description: Field to sort by. Use <code>field:order</code> where order is <code>1</code> for ascending and <code>-1</code> for descending. e.g. <code>created_at:1</code>
schema:
type: string
pattern: ^(([a-zA-Z0-9_\\.]+))\:(1|-1)$
- name: connection
in: query
description: Connection filter. Only applies when using <code>search_engine=v1</code>. To filter by connection with <code>search_engine=v2|v3</code>, use <code>q=identities.connection:"connection_name"</code>
schema:
type: string
- name: fields
in: query
description: Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
schema:
type: string
- name: include_fields
in: query
description: Whether specified fields are to be included (true) or excluded (false).
schema:
type: boolean
- name: q
in: query
description: Query in <a target='_new' href ='https://lucene.apache.org/core/2_9_4/queryparsersyntax.html'>Lucene query string syntax</a>. Some query types cannot be used on metadata fields, for details see <a href='https://auth0.com/docs/users/search/v3/query-syntax#searchable-fields'>Searchable Fields</a>.
schema:
type: string
- name: search_engine
in: query
description: The version of the search engine
schema:
$ref: '#/components/schemas/SearchEngineVersionsEnum'
- name: primary_order
in: query
description: If true (default), results are returned in a deterministic order. If false, results may be returned in a non-deterministic order, which can enhance performance for complex queries targeting a small number of users. Set to false only when consistent ordering and pagination is not required.
schema:
type: boolean
responses:
'200':
description: Users successfully retrieved.
content:
application/json:
schema:
$ref: '#/components/schemas/ListUsersResponseContent'
'400':
description: Invalid request query string. The message will vary depending on the cause.
x-description-1: The 'q' parameter is available only if you specify 'search_engine=v2|v3'.
x-description-2: You are not allowed to use search_engine=v1.
x-description-3: You are not allowed to use search_engine=v2. Use search_engine=v3 instead.
x-description-4: You are not allowed to use search_engine=v3.
x-description-5: You can only page through the first 1000 records. See https://auth0.com/docs/users/search/v3/view-search-results-by-page#limitation.
'401':
description: Client is not global.
x-description-1: Invalid signature received for JSON Web Token validation.
x-description-2: Invalid token.
'403':
description: 'Insufficient scope, expected any of: read:users.'
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
'503':
description: The query exceeded the timeout. Please try refining your search criteria. See https://auth0.com/docs/best-practices/search-best-practices.
operationId: get_users
x-release-lifecycle: GA
x-operation-name: list
x-operation-request-parameters-name: ListUsersRequestParameters
x-operation-group: users
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:users
- read:user_idp_tokens
post:
summary: Create a User
description: 'Create a new user for a given <a href="https://auth0.com/docs/connections/database">database</a> or <a href="https://auth0.com/docs/connections/passwordless">passwordless</a> connection.
Note: <code>connection</code> is required but other parameters such as <code>email</code> and <code>password</code> are dependent upon the type of connection.'
tags:
- users
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateUserRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/CreateUserRequestContent'
responses:
'201':
description: User successfully created.
content:
application/json:
schema:
$ref: '#/components/schemas/CreateUserResponseContent'
'400':
description: Invalid request body. The message will vary depending on the cause.
x-description-1: Connection does not support user creation through the API. It must either be a database or passwordless connection.
x-description-2: Cannot set username for connection without requires_username.
x-description-3: Connection does not exist.
x-description-4: Connection is disabled.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope, expected any of: create:users.'
'409':
description: User already exists.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: post_users
x-release-lifecycle: GA
x-operation-name: create
x-operation-group: users
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- create:users
/users/{id}:
get:
summary: Get a User
description: 'Retrieve user details. A list of fields to include or exclude may also be specified. For more information, see <a href="https://auth0.com/docs/manage-users/user-search/retrieve-users-with-get-users-endpoint">Retrieve Users with the Get Users Endpoint</a>.
'
tags:
- users
parameters:
- name: id
in: path
description: ID of the user to retrieve.
required: true
schema:
type: string
- name: fields
in: query
description: Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
schema:
type: string
pattern: ^((phone_number)|(email)|(email_verified)|(picture)|(username)|(user_id)|(name)|(nickname)|(created_at)|(identities)|(app_metadata)|(user_metadata)|(last_ip)|(last_login)|(logins_count)|(updated_at)|(blocked)|(family_name)|(given_name))(,((phone_number)|(email)|(email_verified)|(picture)|(username)|(user_id)|(name)|(nickname)|(created_at)|(identities)|(app_metadata)|(user_metadata)|(last_ip)|(last_login)|(logins_count)|(updated_at)|(blocked)|(family_name)|(given_name)))*$
- name: include_fields
in: query
description: Whether specified fields are to be included (true) or excluded (false).
schema:
type: boolean
responses:
'200':
description: User successfully retrieved.
content:
application/json:
schema:
$ref: '#/components/schemas/GetUserResponseContent'
'400':
description: Invalid request URI. The message will vary depending on the cause.
x-description-1: Invalid request query string. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: User to be acted on does not match subject in bearer token.
x-description-1: 'Insufficient scope; expected any of: read:users, read:user_idp_tokens, read:current_user.'
'404':
description: User not found.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: get_users_by_id
x-release-lifecycle: GA
x-operation-name: get
x-operation-request-parameters-name: GetUserRequestParameters
x-operation-group: users
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:users
- read:current_user
- read:user_idp_tokens
delete:
summary: Delete a User
description: 'Delete a user by user ID. This action cannot be undone. For Auth0 Dashboard instructions, see <a href="https://auth0.com/docs/manage-users/user-accounts/delete-users">Delete Users</a>.
'
tags:
- users
parameters:
- name: id
in: path
description: ID of the user to delete.
required: true
schema:
type: string
responses:
'204':
description: User successfully deleted.
'400':
description: Invalid request URI. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: User to be acted on does not match subject in bearer token.
x-description-1: 'Insufficient scope; expected any of: delete:users,delete:current_user.'
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: delete_users_by_id
x-release-lifecycle: GA
x-operation-name: delete
x-operation-group: users
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- delete:users
- delete:current_user
patch:
summary: Update a User
description: "Update a user.\n\nThese are the attributes that can be updated at the root level:\n\n<ul>\n <li>app_metadata</li>\n <li>blocked</li>\n <li>email</li>\n <li>email_verified</li>\n <li>family_name</li>\n <li>given_name</li>\n <li>name</li>\n <li>nickname</li>\n <li>password</li>\n <li>phone_number</li>\n <li>phone_verified</li>\n <li>picture</li>\n <li>username</li>\n <li>user_metadata</li>\n <li>verify_email</li>\n</ul>\n\nSome considerations:\n<ul>\n <li>The properties of the new object will replace the old ones.</li>\n <li>The metadata fields are an exception to this rule (<code>user_metadata</code> and <code>app_metadata</code>). These properties are merged instead of being replaced but be careful, the merge only occurs on the first level.</li>\n <li>If you are updating <code>email</code>, <code>email_verified</code>, <code>phone_number</code>, <code>phone_verified</code>, <code>username</code> or <code>password</code> of a secondary identity, you need to specify the <code>connection</code> property too.</li>\n <li>If you are updating <code>email</code> or <code>phone_number</code> you can specify, optionally, the <code>client_id</code> property.</li>\n <li>Updating <code>email_verified</code> is not supported for enterprise and passwordless sms connections.</li>\n <li>Updating the <code>blocked</code> to <code>false</code> does not affect the user's blocked state from an excessive amount of incorrectly provided credentials. Use the \"Unblock a user\" endpoint from the \"User Blocks\" API to change the user's state.</li>\n <li>Supported attributes can be unset by supplying <code>null</code> as the value.</li>\n</ul>\n\n<h5>Updating a field (non-metadata property)</h5>\nTo mark the email address of a user as verified, the body to send should be:\n<pre><code>{ \"email_verified\": true }</code></pre>\n\n<h5>Updating a user metadata root property</h5>Let's assume that our test user has the following <code>user_metadata</code>:\n<pre><code>{ \"user_metadata\" : { \"profileCode\": 1479 } }</code></pre>\n\nTo add the field <code>addresses</code> the body to send should be:\n<pre><code>{ \"user_metadata\" : { \"addresses\": {\"work_address\": \"100 Industrial Way\"} }}</code></pre>\n\nThe modified object ends up with the following <code>user_metadata</code> property:<pre><code>{\n \"user_metadata\": {\n \"profileCode\": 1479,\n \"addresses\": { \"work_address\": \"100 Industrial Way\" }\n }\n}</code></pre>\n\n<h5>Updating an inner user metadata property</h5>If there's existing user metadata to which we want to add <code>\"home_address\": \"742 Evergreen Terrace\"</code> (using the <code>addresses</code> property) we should send the whole <code>addresses</code> object. Since this is a first-level object, the object will be merged in, but its own properties will not be. The body to send should be:\n<pre><code>{\n \"user_metadata\": {\n \"addresses\": {\n \"work_address\": \"100 Industrial Way\",\n \"home_address\": \"742 Evergreen Terrace\"\n }\n }\n}</code></pre>\n\nThe modified object ends up with the following <code>user_metadata</code> property:\n<pre><code>{\n \"user_metadata\": {\n \"profileCode\": 1479,\n \"addresses\": {\n \"work_address\": \"100 Industrial Way\",\n \"home_address\": \"742 Evergreen Terrace\"\n }\n }\n}</code></pre>\n"
tags:
- users
parameters:
- name: id
in: path
description: ID of the user to update.
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateUserRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/UpdateUserRequestContent'
responses:
'200':
description: User successfully updated.
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateUserResponseContent'
'400':
description: Invalid request URI. The message will vary depending on the cause.
x-description-1: Invalid request body. The message will vary depending on the cause.
x-description-2: Connection does not exist.
x-description-3: Connection is not supported for this operation.
x-description-4: Cannot update password and email simultaneously.
x-description-5: Cannot update password and email_verified simultaneously.
x-description-6: Cannot update username and email simultaneously.
x-description-7: Cannot update username and email_verified simultaneously.
x-description-8: Cannot update username and password simultaneously.
x-description-9: Cannot update email for non-database user.
x-description-10: Cannot change email or password for users in a disabled connection.
x-description-11: Email verification is not supported for enterprise users.
x-description-12: 'Your account is not allowed to update the following user attributes: family_name, given_name, name, nickname, picture.'
x-description-13: 'The following user attributes cannot be updated: family_name, given_name, name, nickname, picture. The connection must either be a database connection (using the Auth0 store), a passwordless connection (email or sms) or has disabled ''Sync user profile attributes at each login''.'
x-description-14: 'The following user attributes cannot be updated: family_name, given_name, name, nickname, picture. The specified connection belongs to a secondary identity.'
x-description-15: 'The following user attributes cannot be removed: family_name, given_name, name, nickname, picture. The connection (non-federated-conn) must either be a custom database connection with import mode disabled, a social or enterprise connection.'
x-description-16: 'The following user attributes cannot be removed: foo, bar. The connection (some-connection) should have disabled ''Sync user profile attributes at each login'' (see <a href=''https://auth0.com/docs/users/configure-connection-sync-with-auth0''>Configuring Connection Sync with Auth0</a>) or defined these attributes in ''options.non_persistent_attrs'' array (see <a href=''https://auth0.com/docs/security/denylist-user-attributes''>Add User Attributes to DenyList</a>).'
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: User to be acted on does not match subject in bearer token.
x-description-1: Some fields cannot be read with the permissions granted by the bearer token scopes. The message will vary depending on the fields and the scopes.
x-description-2: 'Insufficient scope; expected any of: update:users,update:users_app_metadata,update:current_user_metadata.'
'404':
description: User not found.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: patch_users_by_id
x-release-lifecycle: GA
x-operation-name: update
x-operation-group: users
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- update:users
- update:users_app_metadata
- update:current_user_metadata
/users/{id}/authentication-methods:
get:
summary: Get a List of Authentication Methods
description: Retrieve detailed list of authentication methods associated with a specified user.
tags:
- users
parameters:
- name: id
in: path
description: The ID of the user in question.
required: true
schema:
type: string
- name: page
in: query
description: Page index of the results to return. First page is 0. Default is 0.
schema:
type: integer
minimum: 0
- name: per_page
in: query
description: Number of results per page. Default is 50.
schema:
type: integer
minimum: 0
maximum: 100
- name: include_totals
in: query
description: Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
schema:
type: boolean
responses:
'200':
description: The authentication methods for the user were retrieved.
content:
application/json:
schema:
$ref: '#/components/schemas/ListUserAuthenticationMethodsResponseContent'
'400':
description: Invalid request URI. The message will vary depending on the cause.
x-description-1: Invalid request query string. The message will vary depending on the cause.
x-description-2: The number of user identifiers associated with a user exceeds the maximum allowed.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation
'403':
description: User to be acted on does not match subject in bearer token.
x-description-1: 'Insufficient scope, expected any of: read:authentication_methods'
'404':
description: The user does not exist.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: get_authentication-methods
x-release-lifecycle: GA
x-operation-name: list
x-operation-request-parameters-name: ListUserAuthenticationMethodsRequestParameters
x-operation-group:
- users
- authenticationMethods
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:authentication_methods
delete:
summary: Delete All Authentication Methods for the Given User
description: 'Remove all authentication methods (i.e., enrolled MFA factors) from the specified user account. This action cannot be undone. '
tags:
- users
parameters:
- name: id
in: path
description: The ID of the user in question.
required: true
schema:
type: string
responses:
'204':
description: Authentication methods successfully deleted.
'400':
description: Invalid request URI. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: User to be acted on does not match subject in bearer token.
x-description-1: 'Insufficient scope; expected any of: delete:authentication_methods'
x-description-2: Operation not permitted when the user has registered at least 1 passkey
x-description-3: The number of user identifiers associated with a user exceeds the maximum allowed.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: delete_authentication-methods
x-release-lifecycle: GA
x-operation-name: deleteAll
x-operation-group:
- users
- authenticationMethods
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- delete:authentication_methods
post:
summary: Creates an Authentication Method for a Given User
description: Create an authentication method. Authentication methods created via this endpoint will be auto confirmed and should already have verification completed.
tags:
- users
parameters:
- name: id
in: path
description: The ID of the user to whom the new authentication method will be assigned.
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateUserAuthenticationMethodRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/CreateUserAuthenticationMethodRequestContent'
responses:
'201':
description: Authentication method created.
content:
application/json:
schema:
$ref: '#/components/schemas/CreateUserAuthenticationMethodResponseContent'
'400':
description: Invalid request URI. The message will vary depending on the cause.
x-description-1: Invalid request query string. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation
'403':
description: You reached the limit of entities of this type for this user.
x-description-1: User to be acted on does not match subject in bearer token.
x-description-2: 'Insufficient scope, expected: create:authentication_methods'
'404':
description: The user does not exist.
'409':
description: Authentication method already exists.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: post_authentication-methods
x-release-lifecycle: GA
x-operation-name: create
x-operation-group:
- users
- authenticationMethods
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- create:authentication_methods
put:
summary: Update All Authentication Methods by Replacing Them with the Given Ones
description: "Replace the specified user <a href=\"https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors\"> authentication methods</a> with supplied values.\n\n <b>Note</b>: Authentication methods supplied through this action do not iterate on existing methods. Instead, any methods passed will overwrite the user’s existing settings."
tags:
- users
parameters:
- name: id
in: path
description: The ID of the user in question.
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SetUserAuthenticationMethodsRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/SetUserAuthenticationMethodsRequestContent'
responses:
'200':
description: All authentication methods successfully updated.
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/SetUserAuthenticationMethodResponseContent'
'400':
description: Invalid request URI. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: User to be acted on does not match subject in bearer token.
x-description-1: 'Insufficient scope; expected: update:authentication_methods'
x-description-2: Operation not permitted when the user has registered at least 1 passkey
x-description-3: The number of user identifiers associated with a user exceeds the maximum allowed.
'409':
description: Authentication method already exists.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: put_authentication-methods
x-release-lifecycle: GA
x-operation-name: set
x-operation-group:
- users
- authenticationMethods
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- update:authentication_methods
/users/{id}/authentication-methods/{authentication_method_id}:
get:
summary: Get an Authentication Method by ID
tags:
- users
parameters:
- name: id
in: path
description: The ID of the user in question.
required: true
schema:
type: string
- name: authentication_method_id
in: path
description: The ID of the authentication methods in question.
required: true
schema:
type: string
responses:
'200':
description: Authentication method retrieved.
content:
application/json:
schema:
$ref: '#/components/schemas/GetUserAuthenticationMethodResponseContent'
'400':
description: Invalid request URI. The message will vary depending on the cause.
x-description-1: Invalid request query string. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation
'403':
description: User to be acted on does not match subject in bearer token.
x-description-1: 'Insufficient scope, expected: read:authentication_methods.'
x-description-2: The number of user identifiers associated with a user exceeds the maximum allowed.
'404':
description: The user does not exist.
x-description-1: The authentication method could not be found.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: get_authentication-methods_by_authentication_method_id
x-release-lifecycle: GA
x-operation-name: get
x-operation-request-parameters-name: GetUserAuthenticationMethodRequestParameters
x-operation-group:
- users
- authenticationMethods
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:authentication_methods
delete:
summary: Delete an Authentication Method by ID
description: Remove the authentication method with the given ID from the specified user. For more information, review <a href="https://auth0.com/docs/secure/multi-factor-authentication/manage-mfa-auth0-apis/manage-authentication-methods-with-management-api">Manage Authentication Methods with Management API</a>.
tags:
- users
parameters:
- name: id
in: path
description: The ID of the user in question.
required: true
schema:
type: string
- name: authentication_method_id
in: path
description: The ID of the authentication method to delete.
required: true
schema:
type: string
responses:
'204':
description: Authentication method successfully deleted.
'400':
description: Invalid request URI. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: User to be acted on does not match subject in bearer token.
x-description-1: 'Insufficient scope; expected any of: delete:authentication_methods'
x-description-2: The number of user identifiers associated with a user exceeds the maximum allowed.
'404':
description: The user does not exist.
x-description-1: The authentication method could not be found.
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
# --- truncated at 32 KB (155 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/openapi/auth0-users-api-openapi.yml