User

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/webrix/main/json-schema/webrix-user-schema.json",
  "title": "User",
  "x-generated": "2026-10-19",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_original/webrix-api-openapi.json#/components/schemas/User",
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "User's display name"
    },
    "email": {
      "type": "string",
      "description": "User's email address"
    },
    "slug": {
      "type": "string",
      "description": "URL-friendly identifier for the user"
    },
    "is_machine_user": {
      "type": "boolean",
      "description": "Whether this is a machine user account"
    },
    "group_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of group IDs the user belongs to"
    },
    "owner_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "For a **machine user**, the IDs of the people accountable for it.\nAlways empty for regular users, who cannot have owners.\n"
    },
    "owned_machine_user_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "For a regular user, the IDs of the machine users they own. Always\nempty for machine users.\n"
    },
    "risk_score": {
      "type": [
        "integer",
        "null"
      ],
      "minimum": 0,
      "maximum": 100,
      "description": "Identity risk score, where a higher number means a riskier user.\n`null` means the user has never been scored, which is distinct from\na score of `0` (assessed and found low risk).\n"
    },
    "risk_score_source": {
      "type": [
        "string",
        "null"
      ],
      "enum": [
        "manual",
        "api",
        "scim",
        "crowdstrike"
      ],
      "description": "What last set `risk_score`. `manual` means an admin set it in the\ndashboard; provider syncs skip those users unless configured to\noverwrite manual scores.\n"
    },
    "risk_score_updated_at": {
      "type": [
        "string",
        "null"
      ],
      "format": "date-time",
      "description": "When `risk_score` was last written"
    },
    "created_at": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp when the user was created"
    },
    "updated_at": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp when the user was last updated"
    },
    "id": {
      "type": "string",
      "format": "uuid",
      "description": "Unique identifier."
    },
    "org_id": {
      "type": "string",
      "format": "uuid",
      "description": "Organization this record belongs to."
    }
  }
}