Qwist User Management API

openapi: 3.2.0
info:
  title: nrich User Management API
  version: '2.10'
  contact:
    name: Qwist GmbH
    email: partnersupport@qwist.com
    url: https://qwist.com
  description: This is the reference for Qwist's nrich API
servers:
- url: https://api.nrich.qwist.cloud
  description: Staging environment
tags:
- name: User Management
paths:
  /auth/user:
    post:
      tags:
      - User Management
      summary: Create a user
      description: The client has to have the `create_user` scope in order to be able to perform this operation.
      operationId: createUser
      security:
      - client_auth: []
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  $ref: '#/paths/~1rest~1user/put/requestBody/content/application~1json/schema/properties/email'
                language:
                  $ref: '#/paths/~1rest~1user/put/requestBody/content/application~1json/schema/properties/language'
                full_name:
                  $ref: '#/paths/~1rest~1user/put/requestBody/content/application~1json/schema/properties/full_name'
                password:
                  type: string
                  example: hunter2
                  description: The nrich account password.
              required:
              - email
              - password
              - full_name
      parameters:
      - name: Content-Type
        in: header
        required: true
        schema:
          type: string
          enum:
          - application/json
        description: The Content-Type entity header is used to indicate the media type of the request.
      responses:
        '201':
          description: User created
        '400':
          $ref: '#/paths/~1rest~1user/put/responses/400'
        '401':
          $ref: '#/paths/~1catalog/get/responses/401'
  /auth/users:
    get:
      tags:
      - User Management
      summary: List users of client
      operationId: listClientUsers
      security:
      - client_auth: []
      parameters:
      - in: query
        name: count
        schema:
          type: integer
          default: 1000
          example: 100
        description: Limit the number of returned items. In combination with the offset parameter this can be used to paginate the result list.
      - in: query
        name: offset
        schema:
          type: integer
          default: 0
          example: 200
        description: Skip this number of items in the response. In combination with the count parameter this can be used to paginate the result list.
      - in: query
        name: since
        schema:
          type: string
          format: date
          example: '2023-01-14'
        description: Only entities with a corresponding date **equal or newer** to this date will be selected.
        example: '2020-02-01'
      - in: query
        name: until
        schema:
          $ref: '#/paths/~1auth~1users/get/parameters/2/schema'
        description: Only entities with a corresponding date **equal or older** to this date will be selected.
        example: '2020-02-01'
      responses:
        '200':
          description: List of users associated with authenticated client.
          content:
            application/json:
              schema:
                type: object
                description: List of users
                properties:
                  users:
                    type: array
                    items:
                      $ref: '#/paths/~1rest~1user/get/responses/200/content/application~1json/schema'
        '400':
          $ref: '#/paths/~1rest~1user/put/responses/400'
        '401':
          $ref: '#/paths/~1catalog/get/responses/401'
  /auth/users/{user_id}:
    delete:
      tags:
      - User Management
      summary: Delete a user of client
      operationId: deleteClientUser
      security:
      - client_auth: []
      parameters:
      - name: user_id
        in: path
        description: The ID of the user to delete (e.g., U12345)
        required: true
        schema:
          type: string
          example: U1152988850366087169
      responses:
        '204':
          $ref: '#/paths/~1rest~1user/delete/responses/204'
        '401':
          $ref: '#/paths/~1catalog/get/responses/401'
        '403':
          description: You do not have the necessary permissions to perform this operation.
          content:
            application/json:
              schema:
                $ref: '#/paths/~1catalog/get/responses/401/content/application~1json/schema'
              example:
                error:
                  code: 1007
                  group: client
                  data: {}
                  description: Forbidden.
        '404':
          $ref: '#/paths/~1auth~1token/post/responses/404'
  /rest/user:
    put:
      summary: Modify user
      operationId: updateUser
      description: Update details of the user associated with the access token used for authentication.
      tags:
      - User Management
      security:
      - user_auth: []
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                  format: email
                  example: user@example.com
                  description: E-mail address/nrich account username.
                language:
                  type: string
                  format: ISO 639-1:2002
                  example: de
                  description: Two-letter language code.
                full_name:
                  type: string
                  example: John Doe
                  description: Full name of the nrich account user.
                new_password:
                  $ref: '#/paths/~1auth~1user/post/requestBody/content/application~1json/schema/properties/password'
                  description: New finX account password. If this field is set, then the field `password` must be set too.
                password:
                  $ref: '#/paths/~1auth~1user/post/requestBody/content/application~1json/schema/properties/password'
                  description: Current finX account password.
      responses:
        '200':
          $ref: '#/paths/~1rest~1user/get/responses/200'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/paths/~1catalog/get/responses/401/content/application~1json/schema'
              example:
                error:
                  code: 1000
                  group: client
                  data: {}
                  description: Bad request.
        '401':
          $ref: '#/paths/~1catalog/get/responses/401'
    delete:
      tags:
      - User Management
      summary: Delete user
      operationId: deleteUser
      description: Delete the user associated with the access token used for authentication. This will also completely remove all financial data of the user from the finX API backend.
      security:
      - user_auth: []
      responses:
        '204':
          description: No content.
        '401':
          $ref: '#/paths/~1catalog/get/responses/401'
        '404':
          $ref: '#/paths/~1auth~1token/post/responses/404'
    get:
      summary: Get user
      operationId: getUser
      description: Show details about the user associated with the access token used for authentication.
      tags:
      - User Management
      security:
      - user_auth: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                properties:
                  id:
                    type: string
                    example: U1234
                    description: nrich account user id.
                  email:
                    $ref: '#/paths/~1rest~1user/put/requestBody/content/application~1json/schema/properties/email'
                  created_at:
                    $ref: '#/paths/~1uploads/post/responses/200/content/application~1json/schema/properties/ended_at'
                    description: Date of User creation.
                  language:
                    $ref: '#/paths/~1rest~1user/put/requestBody/content/application~1json/schema/properties/language'
                  full_name:
                    $ref: '#/paths/~1rest~1user/put/requestBody/content/application~1json/schema/properties/full_name'
                required:
                - id
                - email
                - created_at
                - language
                - full_name
        '401':
          $ref: '#/paths/~1catalog/get/responses/401'
components:
  securitySchemes:
    user_auth:
      type: http
      description: 'In order to access any information belonging to a user, a client has to authenticate with a token linking itself to the user.  This token is called an `access token` and contains information on the client, the user and the level of access the client has to the users data. In order to authenticate using such an access token the HTTP header `Authorization` is set to `Bearer <access token>`. The  `access token` is formatted

        as a JSON Web Token according to [RFC7519](https://tools.ietf.org/html/rfc7519)


        Such an `access token` is either returned when


        * exchanging an authorization code after a successful OAuth login flow

        * logging in with the user''s credentials

        * exchanging a refresh token, which is returned at either of the aforementioned points


        **Authentication errors**


        In case of an authentication error a HTTP code 401 response is returned containing further

        details on the kind of error in the `WWW-Authenticate` header.


        In addition to the below listed scope the flags are used for simple boolean permissions.


        | Flag            | Description                                  |

        | --              | --                                           |

        | submit_payments | Allow submission of payments to bank server  |

        | offline         | Access finX API when the user is not present |

        | create_user     | Allow creation of finX accounts              |


        **Example**


        The string `"accounts=rw submit_payments"` is URL-encoded and passed as the URL

        parameter `scope`.'
      scheme: bearer
      bearerFormat: JWT
      x-bearerInfoFunc: app.decode_token
      x-scopes:
        accounts=rw: Modify accounts
        accounts=ro: Read accounts
        balance=ro: Read account balance
        securities=ro: Read securities
        transactions=ro: Read transactions
        transactions=rw: Modify transactions
        payments=ro: Read payments
        payments=rw: Create/modify payments
        submit_payments: Submit payment to service provider
        user=ro: Read user information
        user=rw: Modify user information
    client_auth:
      x-basicInfoFunc: app.basic_auth
      type: http
      scheme: basic
      description: Client authentication is performed via [HTTP Basic Auth](https://en.wikipedia.org/wiki/Basic_access_authentication) with client ID as username and client secret as password.
x-provenance:
  method: searched
  source: https://docs.qwist.com/reference
  harvested: '2026-10-21'
  tool: harvest-readme-openapi.py
  note: Assembled verbatim from the OpenAPI definition ReadMe embeds in each operation page of the provider's developer portal; paths and components merged by API title, nothing authored.
  assembled_from:
  - https://docs.qwist.com/reference/addprovideraccess.md
  - https://docs.qwist.com/reference/categorizetransactions.md
  - https://docs.qwist.com/reference/createaccesstoken.md
  - https://docs.qwist.com/reference/createaccountverification.md
  - https://docs.qwist.com/reference/createcontract.md
  - https://docs.qwist.com/reference/createincomereport.md
  - https://docs.qwist.com/reference/createmanualsync.md
  - https://docs.qwist.com/reference/createnotification.md
  - https://docs.qwist.com/reference/createonetimeaccess.md
  - https://docs.qwist.com/reference/createonetimeincomereport.md
  - https://docs.qwist.com/reference/createonetimepayment.md
  - https://docs.qwist.com/reference/createonetimeriskreport.md
  - https://docs.qwist.com/reference/createongoingaccess.md
  - https://docs.qwist.com/reference/createongoingpayment.md
  - https://docs.qwist.com/reference/createongoingriskreport.md
  - https://docs.qwist.com/reference/createpayment.md
  - https://docs.qwist.com/reference/createpaymentfromaccount.md
  - https://docs.qwist.com/reference/createqwistlink.md
  - https://docs.qwist.com/reference/createriskreport.md
  - https://docs.qwist.com/reference/createsync.md
  - https://docs.qwist.com/reference/createupload.md
  - https://docs.qwist.com/reference/createuser.md
  - https://docs.qwist.com/reference/createverifyandpay.md
  - https://docs.qwist.com/reference/deleteaccount.md
  - https://docs.qwist.com/reference/deleteclientuser.md
  - https://docs.qwist.com/reference/deletecontract.md
  - https://docs.qwist.com/reference/deletenotification.md
  - https://docs.qwist.com/reference/deletepayment.md
  - https://docs.qwist.com/reference/deleteprovideraccess.md
  - https://docs.qwist.com/reference/deleteuser.md
  - https://docs.qwist.com/reference/getaccount.md
  - https://docs.qwist.com/reference/getaccountbalance.md
  - https://docs.qwist.com/reference/getaccountverificationreceipt.md
  - https://docs.qwist.com/reference/getandgenerateincomereport.md
  - https://docs.qwist.com/reference/getartifact.md
  - https://docs.qwist.com/reference/getcategories.md
  - https://docs.qwist.com/reference/getcategoriesforaccess.md
  - https://docs.qwist.com/reference/getcategoriesforaccount.md
  - https://docs.qwist.com/reference/getcategorytree.md
  - https://docs.qwist.com/reference/getcontract.md
  - https://docs.qwist.com/reference/getcredential.md
  - https://docs.qwist.com/reference/getincomereport.md
  - https://docs.qwist.com/reference/getinsurance.md
  - https://docs.qwist.com/reference/getloan.md
  - https://docs.qwist.com/reference/getnotification.md
  - https://docs.qwist.com/reference/getpaymentchallenge.md
  - https://docs.qwist.com/reference/getpaymentchallengeofaccount.md
  - https://docs.qwist.com/reference/getpaymentinitstatus.md
  - https://docs.qwist.com/reference/getpaymentinitstatusofaccount.md
  - https://docs.qwist.com/reference/getpaymentofaccount.md
  - https://docs.qwist.com/reference/getpaymentpartners.md
  - https://docs.qwist.com/reference/getpaymentpartnersforaccess.md
  - https://docs.qwist.com/reference/getpaymentpartnersforaccount.md
  - https://docs.qwist.com/reference/getpaymentreceipt.md
  - https://docs.qwist.com/reference/getprovideraccess.md
  - https://docs.qwist.com/reference/getriskreport.md
  - https://docs.qwist.com/reference/getsecurityofaccount.md
  - https://docs.qwist.com/reference/getsyncchallenge.md
  - https://docs.qwist.com/reference/getsyncstatus.md
  - https://docs.qwist.com/reference/gettimeline.md
  - https://docs.qwist.com/reference/gettimelineforaccess.md
  - https://docs.qwist.com/reference/gettimelineforaccount.md
  - https://docs.qwist.com/reference/gettransaction.md
  - https://docs.qwist.com/reference/gettransactionofaccount.md
  - https://docs.qwist.com/reference/getuploadstatus.md
  - https://docs.qwist.com/reference/getuser.md
  - https://docs.qwist.com/reference/getversion.md
  - https://docs.qwist.com/reference/initpayment.md
  - https://docs.qwist.com/reference/initpaymentofaccount.md
  - https://docs.qwist.com/reference/listaccounts.md
  - https://docs.qwist.com/reference/listaccountsofaccess.md
  - https://docs.qwist.com/reference/listbanks.md
  - https://docs.qwist.com/reference/listcatalog.md
  - https://docs.qwist.com/reference/listcatalogclientauth.md
  - https://docs.qwist.com/reference/listclientusers.md
  - https://docs.qwist.com/reference/listcontracts.md
  - https://docs.qwist.com/reference/listcontractsofaccess.md
  - https://docs.qwist.com/reference/listcontractsofaccount.md
  - https://docs.qwist.com/reference/listcredentials.md
  - https://docs.qwist.com/reference/listinsurances.md
  - https://docs.qwist.com/reference/listinsurancesofaccess.md
  - https://docs.qwist.com/reference/listloans.md
  - https://docs.qwist.com/reference/listloansofaccess.md
  - https://docs.qwist.com/reference/listnotifications.md
  - https://docs.qwist.com/reference/listpaymentchallenges.md
  - https://docs.qwist.com/reference/listpaymentchallengesofaccount.md
  - https://docs.qwist.com/reference/listpayments.md
  - https://docs.qwist.com/reference/listpaymentsofaccount.md
  - https://docs.qwist.com/reference/listprovideraccesses.md
  - https://docs.qwist.com/reference/listsecurities.md
  - https://docs.qwist.com/reference/listsecuritiesofaccount.md
  - https://docs.qwist.com/reference/listservices.md
  - https://docs.qwist.com/reference/listsyncchallenges.md
  - https://docs.qwist.com/reference/listtransactions.md
  - https://docs.qwist.com/reference/listtransactionsofaccount.md
  - https://docs.qwist.com/reference/patchcredential.md
  - https://docs.qwist.com/reference/removepinfromprovideraccess.md
  - https://docs.qwist.com/reference/replacenotifications.md
  - https://docs.qwist.com/reference/revokeoauthtoken.md
  - https://docs.qwist.com/reference/solvepaymentchallenge.md
  - https://docs.qwist.com/reference/solvepaymentchallengeofaccount.md
  - https://docs.qwist.com/reference/solvesyncchallenge.md
  - https://docs.qwist.com/reference/updatecontract.md
  - https://docs.qwist.com/reference/updatenotification.md
  - https://docs.qwist.com/reference/updateuser.md
  merge:
    pages: 105
    deduped: 1107
    conflicts_kept_first: 0