JSON:API endpoints for Drupal user entities. Config entities are read-only via JSON:API and require authentication.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/drupal-users-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Drupal Users API
contact:
name: Drupal Community
url: https://www.drupal.org/community
termsOfService: https://www.drupal.org/about/legal
version: '1.0'
description: 'Operations tagged Users across 2 of this provider''s published API definitions: drupal-jsonapi-openapi.yml, drupal-rest-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://example.com/jsonapi
description: Drupal JSON:API Base (replace with your Drupal installation base URL)
- url: https://example.com
description: Drupal Site (replace with your Drupal installation base URL)
tags:
- name: Users
description: JSON:API endpoints for Drupal user entities. Config entities are read-only via JSON:API and require authentication.
paths:
/user/user:
get:
operationId: listUsers
summary: List users
description: Retrieves a collection of user entities. Requires authentication and administer users permission to access. Supports filtering, sorting, pagination, sparse fieldsets, and includes.
tags:
- Users
parameters:
- $ref: '#/components/parameters/JsonApiAccept'
- $ref: '#/components/parameters/FilterPath'
- $ref: '#/components/parameters/FilterValue'
- $ref: '#/components/parameters/SortParam'
- $ref: '#/components/parameters/PageLimit'
- $ref: '#/components/parameters/PageOffset'
- $ref: '#/components/parameters/IncludeParam'
- $ref: '#/components/parameters/FieldsParam'
responses:
'200':
description: Collection of user entities returned successfully.
content:
application/vnd.api+json:
schema:
$ref: '#/components/schemas/JsonApiCollection'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
security:
- basicAuth: []
- oAuth2:
- content
servers:
- url: https://example.com/jsonapi
description: Drupal JSON:API Base (replace with your Drupal installation base URL)
/user/user/{uuid}:
get:
operationId: getUser
summary: Get a user
description: Retrieves a single user entity by UUID. Users can read their own profile; administrators can read any user. Sensitive fields like email may be restricted to authenticated users with appropriate permissions.
tags:
- Users
parameters:
- $ref: '#/components/parameters/EntityUuid'
- $ref: '#/components/parameters/JsonApiAccept'
- $ref: '#/components/parameters/IncludeParam'
- $ref: '#/components/parameters/FieldsParam'
responses:
'200':
description: User entity returned successfully.
content:
application/vnd.api+json:
schema:
$ref: '#/components/schemas/JsonApiSingleResponse'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
security:
- basicAuth: []
- oAuth2:
- content
patch:
operationId: updateUser
summary: Update a user
description: Updates an existing user entity by UUID. Users can update their own profiles; administrators can update any user account. Requires authentication.
tags:
- Users
parameters:
- $ref: '#/components/parameters/EntityUuid'
- $ref: '#/components/parameters/JsonApiContentType'
requestBody:
required: true
content:
application/vnd.api+json:
schema:
$ref: '#/components/schemas/JsonApiUpdateRequest'
responses:
'200':
description: User updated successfully.
content:
application/vnd.api+json:
schema:
$ref: '#/components/schemas/JsonApiSingleResponse'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
security:
- basicAuth: []
- oAuth2:
- content
servers:
- url: https://example.com/jsonapi
description: Drupal JSON:API Base (replace with your Drupal installation base URL)
/user/{id}:
get:
operationId: getUser
summary: Get a user
description: Retrieves a single user entity by its numeric ID. Returns the user's account fields and profile data. Anonymous users can retrieve basic information; additional fields require appropriate permissions.
tags:
- Users
parameters:
- $ref: '#/components/parameters/EntityId'
- $ref: '#/components/parameters/AcceptFormat'
responses:
'200':
description: User entity returned successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/User'
'401':
$ref: '#/components/responses/Unauthorized_2'
'403':
$ref: '#/components/responses/Forbidden_2'
'404':
$ref: '#/components/responses/NotFound_2'
security:
- basicAuth: []
- cookieAuth: []
patch:
operationId: updateUser
summary: Update a user
description: Updates an existing user entity by its numeric ID. Only the fields included in the request body are modified. Users can update their own accounts; administrators can update any account. Requires authentication.
tags:
- Users
parameters:
- $ref: '#/components/parameters/EntityId'
- $ref: '#/components/parameters/ContentTypeFormat'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UserInput'
responses:
'200':
description: User updated successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/User'
'400':
$ref: '#/components/responses/BadRequest_2'
'401':
$ref: '#/components/responses/Unauthorized_2'
'403':
$ref: '#/components/responses/Forbidden_2'
'404':
$ref: '#/components/responses/NotFound_2'
security:
- basicAuth: []
- cookieAuth: []
delete:
operationId: deleteUser
summary: Delete a user
description: Permanently deletes a user account entity by its numeric ID. Only administrators with the appropriate permissions can delete user accounts. Requires authentication.
tags:
- Users
parameters:
- $ref: '#/components/parameters/EntityId'
responses:
'204':
description: User deleted successfully. No content returned.
'401':
$ref: '#/components/responses/Unauthorized_2'
'403':
$ref: '#/components/responses/Forbidden_2'
'404':
$ref: '#/components/responses/NotFound_2'
security:
- basicAuth: []
- cookieAuth: []
servers:
- url: https://example.com
description: Drupal Site (replace with your Drupal installation base URL)
components:
parameters:
SortParam:
name: sort
in: query
required: false
description: Sort the results by the given field. Prefix with - for descending order. For example, sort=title for ascending by title or sort=-created for descending by creation date.
schema:
type: string
example: -created
PageOffset:
name: page[offset]
in: query
required: false
description: The number of resources to skip before beginning to return results. Used in combination with page[limit] for pagination.
schema:
type: integer
minimum: 0
default: 0
FilterValue:
name: filter[name][value]
in: query
required: false
description: The value to filter against.
schema:
type: string
example: '1'
EntityUuid:
name: uuid
in: path
required: true
description: The UUID of the entity. JSON:API always uses UUID as the identifier, not the numeric entity ID.
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
FieldsParam:
name: fields[node--article]
in: query
required: false
description: Sparse fieldset parameter to limit which attributes are returned, reducing response payload size. Replace node--article with the relevant resource type. Value is a comma-separated list of field names.
schema:
type: string
example: title,body,created
JsonApiContentType:
name: Content-Type
in: header
required: true
description: Must be application/vnd.api+json for all JSON:API write requests.
schema:
type: string
default: application/vnd.api+json
IncludeParam:
name: include
in: query
required: false
description: A comma-separated list of relationship paths to include in the response. For example, include=uid resolves the author relationship, and include=field_tags includes related taxonomy terms inline.
schema:
type: string
example: uid,field_tags
PageLimit:
name: page[limit]
in: query
required: false
description: The maximum number of resources to return in a single page. Used for cursor-based pagination.
schema:
type: integer
minimum: 1
maximum: 50
default: 50
JsonApiAccept:
name: Accept
in: header
required: false
description: The JSON:API media type. Include this header to receive a properly formatted JSON:API response.
schema:
type: string
default: application/vnd.api+json
FilterPath:
name: filter[name][path]
in: query
required: false
description: The dotted field path to filter on, e.g. title, status, uid.name, or field_tags.name for nested relationship fields.
schema:
type: string
example: status
ContentTypeFormat:
name: Content-Type
in: header
required: true
description: The serialization format of the request body. Must match the format of the data being sent.
schema:
type: string
enum:
- application/json
- application/hal+json
default: application/json
EntityId:
name: id
in: path
required: true
description: The numeric ID of the entity.
schema:
type: integer
minimum: 1
AcceptFormat:
name: Accept
in: header
required: false
description: The desired response serialization format. Defaults to application/json. Use application/hal+json for HAL+JSON hypermedia format.
schema:
type: string
enum:
- application/json
- application/hal+json
- application/xml
default: application/json
schemas:
JsonApiUpdateRequest:
type: object
description: Generic JSON:API update request body.
required:
- data
properties:
data:
type: object
required:
- type
- id
properties:
type:
type: string
description: The JSON:API resource type.
id:
type: string
format: uuid
description: The UUID of the resource being updated.
attributes:
type: object
description: Attributes to update.
relationships:
type: object
description: Relationships to update.
JsonApiResourceObject:
type: object
description: A JSON:API resource object representing a single Drupal entity.
required:
- type
- id
properties:
type:
type: string
description: The JSON:API resource type in the format {entity_type}--{bundle}, e.g. node--article, taxonomy_term--tags.
example: node--article
id:
type: string
format: uuid
description: The UUID of the resource.
attributes:
type: object
description: The resource's field values excluding entity references. Keys are field machine names.
relationships:
type: object
description: The resource's entity reference fields expressed as relationship objects with data containing type and id.
links:
$ref: '#/components/schemas/JsonApiLinks'
JsonApiErrorResponse:
type: object
description: A JSON:API error response containing one or more error objects.
properties:
errors:
type: array
description: Array of error objects describing the problems encountered.
items:
$ref: '#/components/schemas/JsonApiError'
jsonapi:
type: object
properties:
version:
type: string
example: '1.0'
JsonApiError:
type: object
description: A single JSON:API error object.
properties:
status:
type: string
description: The HTTP status code for this error.
title:
type: string
description: A short, human-readable summary of the problem type.
detail:
type: string
description: A human-readable explanation specific to this error occurrence.
source:
type: object
description: An object containing a reference to the source of the error.
properties:
pointer:
type: string
description: A JSON Pointer to the associated entity in the request body.
parameter:
type: string
description: The query parameter that caused the error.
JsonApiCollectionLinks:
type: object
description: Pagination links for collection responses.
properties:
self:
type: object
properties:
href:
type: string
format: uri
description: Link to the current page.
first:
type: object
properties:
href:
type: string
format: uri
description: Link to the first page of results.
prev:
type: object
properties:
href:
type: string
format: uri
description: Link to the previous page of results.
next:
type: object
properties:
href:
type: string
format: uri
description: Link to the next page of results.
last:
type: object
properties:
href:
type: string
format: uri
description: Link to the last page of results.
JsonApiLinks:
type: object
description: Navigation links included in JSON:API responses.
properties:
self:
type: object
description: Link to the current resource or collection.
properties:
href:
type: string
format: uri
description: The URL of the current resource.
related:
type: object
description: Link to a related resource.
properties:
href:
type: string
format: uri
description: The URL of the related resource.
JsonApiSingleResponse:
type: object
description: A JSON:API response containing a single resource object.
properties:
jsonapi:
type: object
description: JSON:API version metadata.
properties:
version:
type: string
description: The JSON:API specification version.
example: '1.0'
data:
$ref: '#/components/schemas/JsonApiResourceObject'
included:
type: array
description: Array of included related resources when using the include parameter.
items:
$ref: '#/components/schemas/JsonApiResourceObject'
links:
$ref: '#/components/schemas/JsonApiLinks'
JsonApiCollection:
type: object
description: A JSON:API collection response containing multiple resource objects.
properties:
jsonapi:
type: object
description: JSON:API version metadata.
properties:
version:
type: string
description: The JSON:API specification version.
example: '1.0'
data:
type: array
description: Array of resource objects.
items:
$ref: '#/components/schemas/JsonApiResourceObject'
included:
type: array
description: Array of included related resources when using the include parameter.
items:
$ref: '#/components/schemas/JsonApiResourceObject'
links:
$ref: '#/components/schemas/JsonApiCollectionLinks'
meta:
type: object
description: Non-standard meta-information about the response, such as total result count.
properties:
count:
type: integer
description: Total number of matching resources across all pages.
ErrorResponse:
type: object
description: Standard error response returned for 4xx HTTP error codes.
properties:
message:
type: string
description: Human-readable description of the error.
IntegerValue:
type: object
description: Drupal field value wrapper for an integer value.
properties:
value:
type: integer
description: The integer value.
User:
type: object
description: A Drupal user account entity with profile and authentication information.
properties:
uid:
type: array
description: The numeric user ID.
items:
$ref: '#/components/schemas/IntegerValue'
uuid:
type: array
description: The universally unique identifier of the user.
items:
$ref: '#/components/schemas/StringValue'
name:
type: array
description: The unique username used for login.
items:
$ref: '#/components/schemas/StringValue'
mail:
type: array
description: The user's email address.
items:
$ref: '#/components/schemas/StringValue'
status:
type: array
description: Account status. 1 for active, 0 for blocked.
items:
$ref: '#/components/schemas/BooleanValue'
created:
type: array
description: Unix timestamp of when the user account was created.
items:
$ref: '#/components/schemas/IntegerValue'
changed:
type: array
description: Unix timestamp of when the user account was last modified.
items:
$ref: '#/components/schemas/IntegerValue'
roles:
type: array
description: List of role references assigned to this user.
items:
$ref: '#/components/schemas/TargetId'
BooleanValue:
type: object
description: Drupal field value wrapper for a boolean value.
properties:
value:
type: integer
description: Boolean represented as integer. 1 for true, 0 for false.
enum:
- 0
- 1
TargetId:
type: object
description: Drupal entity reference value wrapper pointing to a related entity.
properties:
target_id:
type: integer
description: The numeric ID of the referenced entity.
StringValue:
type: object
description: Drupal field value wrapper for a string value.
properties:
value:
type: string
description: The string value.
UserInput:
type: object
description: Request body for updating a Drupal user account. Include only fields to modify.
properties:
name:
type: array
description: The unique username.
items:
$ref: '#/components/schemas/StringValue'
mail:
type: array
description: The user's email address.
items:
$ref: '#/components/schemas/StringValue'
status:
type: array
description: Account status. 1 for active, 0 for blocked.
items:
$ref: '#/components/schemas/BooleanValue'
responses:
BadRequest:
description: The request body or query parameters are invalid.
content:
application/vnd.api+json:
schema:
$ref: '#/components/schemas/JsonApiErrorResponse'
Forbidden:
description: The authenticated user lacks permission to perform this operation.
content:
application/vnd.api+json:
schema:
$ref: '#/components/schemas/JsonApiErrorResponse'
NotFound:
description: The requested resource does not exist or is inaccessible.
content:
application/vnd.api+json:
schema:
$ref: '#/components/schemas/JsonApiErrorResponse'
Unauthorized:
description: Authentication is required to access this resource.
content:
application/vnd.api+json:
schema:
$ref: '#/components/schemas/JsonApiErrorResponse'
Forbidden_2:
description: The authenticated user does not have permission to perform this operation on this resource.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
BadRequest_2:
description: The request body or parameters are invalid or malformed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
NotFound_2:
description: The requested entity does not exist or is not accessible.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized_2:
description: Authentication is required to access this resource.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
securitySchemes:
basicAuth:
type: http
scheme: basic
description: HTTP Basic Authentication using Drupal username and password.
cookieAuth:
type: apiKey
in: cookie
name: SESS
description: Cookie-based session authentication obtained via Drupal login.
oAuth2:
type: oauth2
description: OAuth 2.0 via the Simple OAuth module.
flows:
authorizationCode:
authorizationUrl: https://example.com/oauth/authorize
tokenUrl: https://example.com/oauth/token
scopes:
content: Access and manage content entities
user: Access and manage user entities
x-refined-from:
- drupal-jsonapi-openapi.yml
- drupal-rest-api-openapi.yml