WorkOS user-management.users API

openapi: 3.1.1
info:
  title: WorkOS admin-portal user-management.users API
  description: WorkOS REST API
  version: '1.0'
  contact:
    name: WorkOS
    url: https://workos.com
    email: support@workos.com
  license:
    name: MIT
    url: https://opensource.org/license/MIT
servers:
- url: https://api.workos.com
  description: Production
- url: https://api.workos-test.com
  description: Staging
security:
- bearer: []
tags:
- name: user-management.users
  description: Manage users.
  x-displayName: Users
paths:
  /user_management/email_verification/{id}:
    get:
      description: Get the details of an existing email verification code that can be used to send an email to a user for verification.
      operationId: UserlandUsersController_getEmailVerification
      parameters:
      - name: id
        required: true
        in: path
        description: The ID of the email verification code.
        schema:
          type: string
          example: email_verification_01E4ZCR3C56J083X43JQXF3JK5
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailVerification'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Get an Email Verification Code
      tags:
      - user-management.users
  /user_management/password_reset:
    post:
      description: Creates a one-time token that can be used to reset a user's password.
      operationId: UserlandUsersController_createPasswordResetToken
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePasswordResetTokenDto'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordReset'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: email_password_auth_disabled
                      const: email_password_auth_disabled
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: password_reset_not_allowed
                      const: password_reset_not_allowed
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: The error code identifying the type of error.
                    example: invalid_request_parameters
                    const: invalid_request_parameters
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: Validation failed.
                required:
                - code
                - message
        '429':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: The error code identifying the type of error.
                    example: daily_quota_exceeded
                    const: daily_quota_exceeded
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: Request could not be processed.
                required:
                - code
                - message
      summary: Create a Password Reset Token
      tags:
      - user-management.users
      x-sends-email: true
  /user_management/password_reset/confirm:
    post:
      description: Sets a new password using the `token` query parameter from the link that the user received. Successfully resetting the password will verify a user's email, if it hasn't been verified yet.
      operationId: UserlandUsersController_resetPassword[0]
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePasswordResetDto'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResetPasswordResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: The error code identifying the type of error.
                    example: password_reset_error
                    const: password_reset_error
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: Validation failed.
                  errors:
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          type: string
                          description: The validation error code.
                          example: unknown_event_type
                        message:
                          type: string
                          description: A human-readable description of the validation error.
                          example: Invalid enum value.
                      required:
                      - code
                      - message
                    description: The list of validation errors.
                required:
                - code
                - message
                - errors
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: The error code identifying the type of error.
                    example: email_password_auth_disabled
                    const: email_password_auth_disabled
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: Request could not be processed.
                required:
                - code
                - message
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: The error code identifying the type of error.
                    example: invalid_request_parameters
                    const: invalid_request_parameters
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: Validation failed.
                required:
                - code
                - message
      summary: Reset the Password
      tags:
      - user-management.users
  /user_management/password_reset/{id}:
    get:
      description: Get the details of an existing password reset token that can be used to reset a user's password.
      operationId: UserlandUsersController_getPasswordReset
      parameters:
      - name: id
        required: true
        in: path
        description: The ID of the password reset token.
        schema:
          type: string
          example: password_reset_01E4ZCR3C56J083X43JQXF3JK5
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordReset'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Get a Password Reset Token
      tags:
      - user-management.users
  /user_management/users:
    get:
      description: Get a list of all of your existing users matching the criteria specified.
      operationId: UserlandUsersController_list[0]
      parameters:
      - name: before
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
        schema:
          example: xxx_01HXYZ123456789ABCDEFGHIJ
          type: string
      - name: after
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
        schema:
          example: xxx_01HXYZ987654321KJIHGFEDCBA
          type: string
      - name: limit
        required: false
        in: query
        description: Upper limit on the number of objects to return, between `1` and `100`.
        schema:
          minimum: 1
          maximum: 100
          default: 10
          example: 10
          type: integer
      - name: order
        required: false
        in: query
        description: Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
        schema:
          $ref: '#/components/schemas/PaginationOrder'
      - name: organization
        required: false
        in: query
        deprecated: true
        description: Filter users by the organization they are a member of. Deprecated in favor of `organization_id`.
        schema:
          example: org_01EHZNVPK3SFK441A1RGBFSHRT
          type: string
      - name: organization_id
        required: false
        in: query
        description: Filter users by the organization they are a member of.
        schema:
          example: org_01EHZNVPK3SFK441A1RGBFSHRT
          type: string
      - name: email
        required: false
        in: query
        description: Filter users by their email address.
        schema:
          example: user@example.com
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserlandUserList'
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: List Users
      tags:
      - user-management.users
    post:
      description: Create a new user in the current environment.
      operationId: UserlandUsersController_create[0]
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateUserlandUserDto'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserlandUser'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: password_strength_error
                      const: password_strength_error
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Validation failed.
                    errors:
                      type: array
                      items:
                        type: object
                        properties:
                          code:
                            type: string
                            description: The validation error code.
                            example: unknown_event_type
                          message:
                            type: string
                            description: A human-readable description of the validation error.
                            example: Invalid enum value.
                        required:
                        - code
                        - message
                      description: The list of validation errors.
                  required:
                  - code
                  - message
                  - errors
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: user_creation_error
                      const: user_creation_error
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Validation failed.
                    errors:
                      type: array
                      items:
                        type: object
                        properties:
                          code:
                            type: string
                            description: The validation error code.
                            example: unknown_event_type
                          message:
                            type: string
                            description: A human-readable description of the validation error.
                            example: Invalid enum value.
                        required:
                        - code
                        - message
                      description: The list of validation errors.
                  required:
                  - code
                  - message
                  - errors
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: invalid_password_hash
                      const: invalid_password_hash
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: password_and_password_hash_provided
                      const: password_and_password_hash_provided
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: password_and_password_hash_type_provided
                      const: password_and_password_hash_type_provided
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: invalid_metadata
                      const: invalid_metadata
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: The error code identifying the type of error.
                    example: invalid_request_parameters
                    const: invalid_request_parameters
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: Validation failed.
                required:
                - code
                - message
      summary: Create a User
      tags:
      - user-management.users
      x-mutually-exclusive-body-groups:
        password:
          optional: true
          variants:
            plaintext:
            - password
            hashed:
            - password_hash
            - password_hash_type
  /user_management/users/external_id/{external_id}:
    get:
      description: Get the details of an existing user by an [external identifier](/authkit/metadata/external-identifiers).
      operationId: UserlandUsersController_getByExternalId
      parameters:
      - name: external_id
        required: true
        in: path
        description: The external ID of the user.
        schema:
          example: f1ffa2b2-c20b-4d39-be5c-212726e11222
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserlandUser'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Get a User by External ID
      tags:
      - user-management.users
  /user_management/users/{id}:
    put:
      description: Updates properties of a user. The omitted properties will be left unchanged.
      operationId: UserlandUsersController_update[0]
      parameters:
      - name: id
        required: true
        in: path
        description: The unique ID of the user.
        schema:
          example: user_01E4ZCR3C56J083X43JQXF3JK5
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserlandUserDto'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserlandUser'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: password_strength_error
                      const: password_strength_error
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Validation failed.
                    errors:
                      type: array
                      items:
                        type: object
                        properties:
                          code:
                            type: string
                            description: The validation error code.
                            example: unknown_event_type
                          message:
                            type: string
                            description: A human-readable description of the validation error.
                            example: Invalid enum value.
                        required:
                        - code
                        - message
                      description: The list of validation errors.
                  required:
                  - code
                  - message
                  - errors
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: invalid_password_hash
                      const: invalid_password_hash
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: password_and_password_hash_provided
                      const: password_and_password_hash_provided
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: password_and_password_hash_type_provided
                      const: password_and_password_hash_type_provided
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: email_already_verified
                      const: email_already_verified
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: invalid_metadata
                      const: invalid_metadata
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: external_id_already_used
                      const: external_id_already_used
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: email_change_not_allowed
                      const: email_change_not_allowed
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: email_not_available
                      const: email_not_available
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: invalid_email
                      const: invalid_email
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
                - type: object
                  properties:
                    code:
                      type: string
                      description: The error code identifying the type of error.
                      example: invalid_locale
                      const: invalid_locale
                    message:
                      type: string
                      description: A human-readable description of the error.
                      example: Request could not be processed.
                  required:
                  - code
                  - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: The error code identifying the type of error.
                    example: invalid_request_parameters
                    const: invalid_request_parameters
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: Validation failed.
                required:
                - code
                - message
      summary: Update a User
      tags:
      - user-management.users
      x-mutually-exclusive-body-groups:
        password:
          optional: true
          variants:
            plaintext:
            - password
            hashed:
            - password_hash
            - password_hash_type
    get:
      description: Get the details of an existing user.
      operationId: UserlandUsersController_get[0]
      parameters:
      - name: id
        required: true
        in: path
        description: The unique ID of the user.
        schema:
          example: user_01E4ZCR3C56J083X43JQXF3JK5
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserlandUser'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
        

# --- truncated at 32 KB (86 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/workos/refs/heads/main/openapi/workos-user-management-users-api-openapi.yml