Cisco Umbrella Users API

openapi: 3.2.0
info:
  title: Cisco Umbrella and Roles Users API
  version: 2.0.0
  description: Manage the Umbrella user accounts and roles.
  contact:
    name: Cloud Security Developer Community
  x-provenance:
    method: harvested
    authored_by: Cisco Umbrella
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    provider_published: true
    source_host: pubhub.devnetcloud.com
    note: 26 first-party OpenAPI 3.0 documents (256 operations) listed by Cisco's own docs-nav config and fetched anonymously. Byte-identity reconfirmed 2026-08-19 by SHA-256 against the live source.
  x-evidence:
  - type: source
    url: https://pubhub.devnetcloud.com/media/cloud-security-apis-in-eft/docs/umbrella-config.json
  - type: source
    url: https://developer.cisco.com/docs/cloud-security/
servers:
- url: https://api.umbrella.com/{basePath}
  variables:
    basePath:
      default: admin/v2
security:
- oauthFlow: []
tags:
- name: Users
paths:
  /users:
    post:
      tags:
      - Users
      description: "Create an Umbrella user account with a designated role.\n\nOnce a user account is deleted, you can recreate the account through the `POST` operation.\nWhen you recreate the user account, only set the `email` and `roleId` fields in the Request Body.\n\nFor example: {\n  \"email\": \"DEVWKS-22@mailinator.com\",\n  \"roleId\": 1\n}\n\nIf you provide all fields for the user account in the Request Body, Umbrella returns an `HTTP/400` (Bad Request) with the\nmessage: `Email already in use`."
      summary: Create User
      operationId: createUser
      security:
      - oauthFlow:
        - admin.users:write
      requestBody:
        content:
          application/json:
            schema:
              properties:
                firstname:
                  type: string
                  description: The user's first name.
                  minLength: 1
                lastname:
                  type: string
                  description: The user's last name.
                  minLength: 1
                email:
                  type: string
                  description: The user's email address.
                  minLength: 1
                password:
                  type: string
                  description: The user's password.
                  minLength: 1
                roleId:
                  type: integer
                  description: The role ID.
                  minimum: 1
                timezone:
                  type: string
                  description: The user's timezone.
                  minLength: 1
              type: object
              required:
              - email
              - password
              - firstname
              - lastname
              - roleId
              - timezone
            example:
              firstname: user first name
              lastname: user last name
              email: user email
              password: user password
              roleId: 1
              timezone: user timezone name
        description: Create a user account.
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              $ref: '#/components/headers/Content-Type'
            Date:
              $ref: '#/components/headers/Date'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserObject'
              example:
                id: 1234
                firstname: user first name
                lastname: user last name
                email: user email
                role: user role name
                roleId: 2
                timezone: user timezone name
                status: user status
                lastLoginTime: '2018-06-13T16:07:07.222Z'
                twoFactorEnable: true
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
    get:
      tags:
      - Users
      description: List the user accounts in the organization.
      summary: List Users
      operationId: listUsers
      security:
      - oauthFlow:
        - admin.users:read
      parameters:
      - $ref: '#/components/parameters/pageParam'
      - $ref: '#/components/parameters/limitParam'
      responses:
        '200':
          description: List the user accounts.
          headers:
            Content-Type:
              $ref: '#/components/headers/Content-Type'
            Date:
              $ref: '#/components/headers/Date'
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UserObject'
              example:
              - id: 1234
                firstname: user first name
                lastname: user last name
                email: user email
                role: user role name
                roleId: 2
                timezone: user timezone name
                status: user status
                lastLoginTime: '2018-06-13T16:07:07.222Z'
                twoFactorEnable: true
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /users/{userId}:
    get:
      tags:
      - Users
      description: Get a user account.
      summary: Get User
      operationId: getUser
      security:
      - oauthFlow:
        - admin.users:read
      parameters:
      - name: userId
        description: The user's ID.
        schema:
          type: integer
        in: path
        required: true
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              $ref: '#/components/headers/Content-Type'
            Date:
              $ref: '#/components/headers/Date'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserObject'
              example:
                id: 1234
                email: user email
                role: user role name
                roleId: 2
                timezone: user timezone name
                status: user status
                twoFactorEnable: true
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
    delete:
      tags:
      - Users
      description: Delete a user account.
      summary: Delete User
      operationId: deleteUser
      security:
      - oauthFlow:
        - admin.users:write
      parameters:
      - name: userId
        description: The user's ID.
        schema:
          type: integer
        in: path
        required: true
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              $ref: '#/components/headers/Content-Type'
            Date:
              $ref: '#/components/headers/Date'
          content:
            application/json:
              schema:
                type:
                - string
                - 'null'
              example: ''
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /passwordResets/{customerId}:
    post:
      tags:
      - Users
      description: 'Renew the passwords for the user accounts in the child (customer) organization of a provider organization.


        For each email address, Umbrella identifies the user''s account and renews the password for the user account.

        Umbrella does not send a renewal request to the user account''s email address.


        Once an admin resets the user account password through the `/passwordResets/{customerId}` API endpoint,

        a user can sign into their account on the child (customer) organization''s managed console

        and reset the password for their user account.


        The `/passwordResets/{customerId}` API endpoint is only available for parent (provider) organizations

        on the Multi-org or provider console.'
      summary: Create Password Resets
      operationId: createPasswordResets
      security:
      - oauthFlow:
        - admin.passwordreset:write
      parameters:
      - $ref: '#/components/parameters/customerIdParam'
      requestBody:
        description: 'Provide a list of email addresses for the user accounts in a child (customer) organization.

          Umbrella renews the password for each user account identified by the account''s email address.'
        content:
          application/json:
            schema:
              type: object
              description: Renew the passwords for the user accounts in the child (customer) organization.
              properties:
                adminEmails:
                  type: array
                  description: A list of email addresses for the user accounts in a child (customer) organization.
                  items:
                    type: string
                    description: 'An email address used to renew the user account''s password.

                      Umbrella does not send an email to the user account''s email address.'
                    example: xac@adc.com
            example:
              adminEmails:
              - account@adc.com
              - account@cisco.com
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              $ref: '#/components/headers/Content-Type'
            Date:
              $ref: '#/components/headers/Date'
          content:
            application/json:
              schema:
                type:
                - string
                - 'null'
                description: Created a password renewal request for each user account identified by the account's email address.
              example: ''
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /organizations:
    get:
      tags:
      - Users
      description: 'Get information about your provider organizations.

        To query the collection, provide an email address for a member of an Umbrella provider organization.'
      summary: Get Information About Organizations
      operationId: getOrganizationInformation
      security:
      - oauthFlow:
        - admin.organizations:read
      parameters:
      - $ref: '#/components/parameters/emailParam'
      - $ref: '#/components/parameters/pageParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              $ref: '#/components/headers/Content-Type'
            Date:
              $ref: '#/components/headers/Date'
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OrgInformation'
              example:
              - organizationId: 2622114
                originId: 299707978
                resellerId: 0
                creatorUserId: 100000
                accountManagerUserId: 0
                organizationName: GTS - MSSP Console
                website: cisco.com
                mspOrganizationId: 0
                organizationTypeId: 1
                createdAt: 1565986232
                modifiedAt: 1585081693
                salesforceAccountId: 0011T00002QfUGgQAN
                hasDelegatedAdmin: true
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404EmailError'
        '500':
          $ref: '#/components/responses/500Error'
components:
  parameters:
    pageParam:
      name: page
      in: query
      description: The number of a page in the collection.
      schema:
        type: integer
        format: int32
        default: 1
        minimum: 1
      required: false
      example: 2
    offsetParam:
      in: query
      name: offset
      required: false
      description: The place to start reading in the collection. The default offset is 0.
      schema:
        type: integer
        format: int64
        default: 0
      example: 10
    customerIdParam:
      name: customerId
      in: path
      description: The child (customer) organization ID.
      required: true
      schema:
        type: integer
        format: int32
      example: 1234556
    emailParam:
      in: query
      name: email
      description: The email address for a member of a provider organization.
      required: true
      schema:
        type: string
      example: name@cisco.com
    limitParam:
      name: limit
      in: query
      description: The number of records from the collection to return on the page.
      required: false
      schema:
        default: 100
        type: integer
        format: int32
        minimum: 1
        maximum: 100
      example: 50
  headers:
    Content-Type:
      schema:
        type: string
      description: The MIME content type of the response body.
      example: application/json
    Date:
      schema:
        type: string
        format: iso-date-time
      description: 'The date and time of the request that is represented in ISO 8601 format.

        The timestamp uses Greenwich Mean Time (GMT).'
      example: 'Date: Mon, 18 Apr 2022 11:11:11 GMT'
  responses:
    401Error:
      description: Unauthorized
      headers:
        Content-Type:
          $ref: '#/components/headers/Content-Type'
        Date:
          $ref: '#/components/headers/Date'
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
          example:
            message: Unauthorized request
    500Error:
      description: Internal Server Error
      headers:
        Content-Type:
          $ref: '#/components/headers/Content-Type'
        Date:
          $ref: '#/components/headers/Date'
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
          example:
            message: Server error
    403Error:
      description: Forbidden
      headers:
        Content-Type:
          $ref: '#/components/headers/Content-Type'
        Date:
          $ref: '#/components/headers/Date'
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
          example:
            message: Forbidden
    404EmailError:
      description: Not Found
      headers:
        Content-Type:
          $ref: '#/components/headers/Content-Type'
        Date:
          $ref: '#/components/headers/Date'
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
          example:
            message: 'The user identified by the email address

              does not exist in the organization.'
    404Error:
      description: Not Found
      headers:
        Content-Type:
          $ref: '#/components/headers/Content-Type'
        Date:
          $ref: '#/components/headers/Date'
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
          example:
            message: Not Found
    400Error:
      description: Bad Request
      headers:
        Content-Type:
          $ref: '#/components/headers/Content-Type'
        Date:
          $ref: '#/components/headers/Date'
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
          example:
            message: Invalid request
  schemas:
    UserObject:
      type: object
      properties:
        firstname:
          type: string
          description: The user's first name.
          minLength: 1
        lastname:
          type: string
          description: The user's last name.
          minLength: 1
        email:
          type: string
          description: The user's email address.
          minLength: 1
        password:
          type: string
          description: The user's password.
          minLength: 1
        roleId:
          type: integer
          description: The role ID.
          minimum: 1
        role:
          type: string
          description: The user's role.
        timezone:
          type: string
          description: The user's timezone.
          minLength: 1
        status:
          type: string
          description: The user's status.
          example: 'on'
        lastLoginTime:
          type: string
          format: date-time
          description: The user's last login date and time (ISO8601 timestamp).
          example: '2018-06-13T16:07:07.222Z'
        twoFactorEnable:
          type: boolean
          description: Specifies whether two-factor authentication is enabled.
      required:
      - id
      - email
      - role
      - roleId
      - timezone
      - status
      - twoFactorEnable
      example:
        id: 123
        email: myemail.com
        role: full admin
        roleId: 1
        timezone: '2018-06-13T16:07:07.222Z'
        status: 'on'
        twoFactorEnable: true
    OrgInformation:
      type: object
      required:
      - mspOrganizationId
      - organizationId
      - organizationName
      - organizationTypeId
      properties:
        organizationId:
          type: integer
          format: int32
          description: The organization ID.
          example: 2622114
        originId:
          type: integer
          description: The origin ID.
          format: int32
          example: 299707978
        resellerId:
          type: integer
          description: The reseller ID.
          example: 0
        creatorUserId:
          type: integer
          description: The user ID of the creator.
          example: 100000
        accountManagerUserId:
          type: integer
          description: The user ID of the account manager.
          example: 0
        organizationName:
          type: string
          description: The name of the organization.
          example: GTS Test - MSSP Console
        website:
          type: string
          description: The URL for the organization.
          example: cisco.com
        mspOrganizationId:
          type: integer
          format: int32
          description: The managed service provider (MSP) ID.
          example: 12345698
        organizationTypeId:
          type: integer
          format: int32
          description: The type ID of the organization.
          example: 4
        createdAt:
          type: integer
          format: int32
          description: The date when the organization was created.
          example: 1565986232
        modifiedAt:
          type: integer
          format: int32
          description: The date when the organization was last modified.
          example: 1585081693
        salesforceAccountId:
          type: string
          description: The Salesforce account ID.
          example: 0011T00002QfUGgQAN
        hasDelegatedAdmin:
          type: boolean
          description: Specifies whether the organization has assigned an administrator.
          example: true
      example:
        organizationId: 2622114
        originId: 299707978
        resellerId: 0
        creatorUserId: 100000
        accountManagerUserId: 0
        organizationName: GTS Test - MSSP Console
        website: cisco.com
        mspOrganizationId: 1223445
        organizationTypeId: 4
        createdAt: 1565986232
        modifiedAt: 1585081693
        salesforceAccountId: 0011T00002QfUGgQAN
        hasDelegatedAdmin: true
  securitySchemes:
    oauthFlow:
      type: oauth2
      description: client credential flow
      flows:
        clientCredentials:
          tokenUrl: https://api.umbrella.com/auth/v2/token
          scopes:
            admin.users:read: Read admin users
            admin.users:write: Write admin users
            admin.roles:read: Read admin roles
            admin.passwordreset:write: Write admin passwords
            admin.organizations:write: Read admin organizations
x-provenance:
  method: harvested
  first_party: true
  harvested: '2026-08-19'
  source: https://pubhub.devnetcloud.com/media/cloud-security-apis-in-eft/docs/reference/admin/users-roles.yaml
  publisher: Cisco Systems, Inc. (Cisco DevNet Cloud Security docs)
x-evidence:
  fetched: '2026-08-19'
  url: https://pubhub.devnetcloud.com/media/cloud-security-apis-in-eft/docs/reference/admin/users-roles.yaml
  http_status: 200
  docs: https://developer.cisco.com/docs/cloud-security/