# Jentic Users API **Canonical:** https://apis.io/apis/jentic/jentic-users-api/ **Provider:** Jentic — https://apis.io/providers/jentic/ **Base URL:** https://api.jentic.com/mcp **Documentation:** https://docs.jentic.com/guides/mcp/remote-mcp/ Jentic Users API is one of 39 APIs that [Jentic](https://apis.io/providers/jentic/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Users. The published artifact set on APIs.io includes an OpenAPI specification. Part of the **Admin / Audit** bounded context — the human roster of the organisation. One organisation, many users; admin surfaces here cover create / list / read / update / delete plus the AIP-style action verbs (`:disable`, `:enable`, `:reissue-invite`). Self-service is intentionally minimal: `GET /users/me` to introspect, `POST /users/me:change-password` to rotate (which re-mints and returns a fresh token, clearing any `must_change_password` gate so the caller need not re-login). **First-run setup (no default credentials).** The platform ships with an empty users table — there is no seeded `admin@local` account. On a fresh install `GET /health` reports `setup_required: true` (with `next_step: create_admin`). The operator creates the first administrator via `POST /users:create-admin {email, password}`: a one-time, unauthenticated endpoint that succeeds only while no user exists, grants `org:admin`, and returns an auto-login `LoginResponse` with `must_change_password: false` (the operator chose the password, so there is no forced rotation). It **self-closes** — once any user exists it returns `410 setup_already_complete`, so it is safe to leave exposed during first boot; a single-row setup sentinel is the concurrency backstop against racing callers (even ones using different emails). After the first user exists, `setup_required` flips to `false`. **Onboarding flow.** Admins create new users via `POST /users` (no password supplied). The response carries a one-time `inv_…` invite token shown **once**; the admin hands it off out-of-band (Slack, 1Password, email — there is no platform-side email infrastructure in this revision). The new user redeems via `POST /users:redeem-invite {invite_token, password}` and is auto-logged-in via the returned `LoginResponse`. Tokens default to a 7-day TTL and are single-use; `:reissue-invite` issues a fresh one if the original is lost or expired. **Authentication.** Today only local (username + password) identity ships. The `User` schema carries `auth_provider: local | external` and an `external_subject_id` field reserved for future SSO integrations (Okta, Cognito, Azure AD); when SSO arrives, those users will be created via a separate provider-specific router. The on-the-wire token contract — `Authorization: Bearer ` — is unchanged either way. **Disabling and revocation.** `:disable` flips `active=false` and rejects subsequent `POST /auth/login` **and** `POST /auth/refresh`. **Existing JWTs keep working until they expire** (≤ 1 hour with the platform's default TTL). This is a deliberate trade-off; sub-minute revocation would require a server-side session table. **Session lifetime.** Login JWTs carry a 1-hour TTL. The UI keeps an active session alive by calling `POST /auth/refresh` before expiry (sliding session); refresh re-reads permissions and the `must_change_password` gate from the database and is refused with 401 `session_expired` once the original authentication is older than the absolute window (`admin.auth.session_ttl_seconds`, 12 hours by default), forcing a fresh login. ## Operations (15) | Method | Path | Summary | |---|---|---| | POST | `/auth/login` | Log in | | POST | `/auth/refresh` | Refresh session token | | GET | `/users` | List Users | | POST | `/users` | Create User | | GET | `/users/me` | Get current user | | POST | `/users/me:change-password` | Change own password | | DELETE | `/users/{user_id}` | Delete User | | GET | `/users/{user_id}` | Get User | | PATCH | `/users/{user_id}` | Update User | | PUT | `/users/{user_id}/permissions` | Set User Permissions | | POST | `/users/{user_id}:disable` | Disable User | | POST | `/users/{user_id}:enable` | Enable User | | POST | `/users/{user_id}:reissue-invite` | Reissue Invite | | POST | `/users:create-admin` | Create first admin (one-time setup) | | POST | `/users:redeem-invite` | Redeem invite | ## Machine-readable artifacts (1) - **OpenAPI** — https://artifacts.apis.io/jentic/openapi/jentic-users-api-openapi.yml ## Other Jentic APIs (12) - [Jentic Remote MCP Server](https://apis.io/apis/jentic/jentic-mcp/) - [Arazzo Engine](https://apis.io/apis/jentic/arazzo-engine/) - [Jentic Standard Agent](https://apis.io/apis/jentic/standard-agent/) - [Jentic Mini](https://apis.io/apis/jentic/jentic-mini/) - [Jentic API AI-Readiness Framework (JAIRF)](https://apis.io/apis/jentic/jairf/) - [Jentic Authentication API](https://apis.io/apis/jentic/jentic-authentication-api/) - [Jentic Execution API](https://apis.io/apis/jentic/jentic-execution-api/) - [Jentic Search API](https://apis.io/apis/jentic/jentic-search-api/) - [Jentic Access Requests API](https://apis.io/apis/jentic/jentic-access-requests-api/) - [Jentic Actors API](https://apis.io/apis/jentic/jentic-actors-api/) - [Jentic Agent Registration API](https://apis.io/apis/jentic/jentic-agent-registration-api/) - [Jentic Agents API](https://apis.io/apis/jentic/jentic-agents-api/) ## Tags Users --- Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/jentic/jentic-users-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/jentic/.