Users | sfp | flxbl docs

Get user by email

get

Retrieves detailed information about a specific user by their email address.

    Access control:
    - Self-lookup: Users can always retrieve their own full profile
    - Owner lookup: Owners can view other users but receive limited data (no sensitive auth metadata)
    - Team-specific lookup: Optionally filter by team using the team slug parameter
    
    Returns user profile including account details, team memberships, and appropriate metadata based on access level.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

emailstringRequired

User email

Query parameters

teamstringOptional

Team slug (optional for self-lookups)

Responses

200

User profile retrieved successfully

application/json

idstringRequired

User ID

firstNamestringRequired

First name of the user

lastNamestringRequired

Last name of the user

emailstringRequired

Email address of the user

rolestring · enumRequired

Role of the user in the team

Possible values:

teamsstring[]Optional

Team details the user belongs to

authDataobjectOptional

Full Supabase auth user data

actualEmailstringOptional

Actual email from JWT for GitHub users (when different from constructed email)

Example: [email protected]

400

Bad request

401

Unauthorized

403

Forbidden - Requires role: owner, member, application

404

User not found

get

/sfp/api/users/{email}

GET /sfp/api/users/{email} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "id": "text",
  "firstName": "text",
  "lastName": "text",
  "email": "text",
  "role": "owner",
  "teams": [
    "text"
  ],
  "authData": {},
  "actualEmail": "[email protected]"
}

Update user details

put

Updates user profile information. Users can update: - Their own profile (self-update) - Other users' profiles if they have owner role

    Updatable fields include:
    - User metadata (first name, last name)
    - Role assignments within teams
    - Team associations
    
    The endpoint validates permissions and ensures users cannot escalate their own privileges. Returns the updated user profile on success.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

emailstringRequired

User email

Query parameters

teamstringOptional

Team slug (optional)

Body

firstNamestringOptional

First name of the user

Example: John

lastNamestringOptional

Last name of the user

Example: Doe

rolestring · enumOptional

Role of the user in the team

Possible values:

Responses

200

User updated successfully

application/json

successbooleanRequired

Whether the operation was successful

errorstringOptional

Error message if operation failed

400

Bad request

401

Unauthorized

404

User not found

put

/sfp/api/users/{email}

PUT /sfp/api/users/{email} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 52

{
  "firstName": "John",
  "lastName": "Doe",
  "role": "owner"
}

{
  "success": true,
  "user": {
    "id": "text",
    "firstName": "text",
    "lastName": "text",
    "email": "text",
    "role": "owner",
    "teams": [
      "text"
    ],
    "authData": {},
    "actualEmail": "[email protected]"
  },
  "error": "text"
}

List users or lookup by GitHub username/email

get

Three modes of operation:

    **Lookup by GitHub** (when lookup=github):
    - Resolves a GitHub username to user profile
    - Use: GET /users?lookup=github&id=<username>
    - Returns full user profile or 404 if not found
    
    **Lookup by Email** (when lookup=email):
    - Looks up user by email address
    - Use: GET /users?lookup=email&id=<email>
    - Returns full user profile or 404 if not found
    
    **List mode** (default):
    - Retrieves a paginated list of users
    - Can filter by team (using team slug) or role
    - Returns user details including email, role, team memberships

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

lookupstring · enumOptional

Lookup mode

Possible values:

idstringOptional

Identifier for lookup (GitHub username or email)

Example: octocat

teamstringOptional

Team slug to filter by

Example: engineering

limitnumberOptional

Number of records to return

Example: 10

offsetnumberOptional

Number of records to skip

Example: 0

rolestring · enumOptional

Filter by role

Possible values:

Responses

200

Users retrieved successfully or lookup successful

application/json

idstringRequired

User ID

firstNamestringRequired

First name of the user

lastNamestringRequired

Last name of the user

emailstringRequired

Email address of the user

rolestring · enumRequired

Role of the user in the team

Possible values:

teamsstring[]Optional

Team details the user belongs to

authDataobjectOptional

Full Supabase auth user data

actualEmailstringOptional

Actual email from JWT for GitHub users (when different from constructed email)

Example: [email protected]

400

Bad request - missing id parameter for lookup

401

Unauthorized

403

Forbidden - Requires role: owner, member, application

404

User not found (lookup mode only)

get

/sfp/api/users

GET /sfp/api/users HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "id": "text",
  "firstName": "text",
  "lastName": "text",
  "email": "text",
  "role": "owner",
  "teams": [
    "text"
  ],
  "authData": {},
  "actualEmail": "[email protected]"
}

Get current user profile

get

Retrieves the complete profile of the currently authenticated user. Returns: - User identification (ID, email) - Account details and role - Team memberships - Authentication metadata (first name, last name) - JWT token information if available

    This endpoint is useful for applications to understand the current user's permissions and profile after authentication.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

User profile retrieved successfully

application/json

idstringRequired

User ID

firstNamestringRequired

First name of the user

lastNamestringRequired

Last name of the user

emailstringRequired

Email address of the user

rolestring · enumRequired

Role of the user in the team

Possible values:

teamsstring[]Optional

Team details the user belongs to

authDataobjectOptional

Full Supabase auth user data

actualEmailstringOptional

Actual email from JWT for GitHub users (when different from constructed email)

Example: [email protected]

401

Unauthorized

get

/sfp/api/users/me

GET /sfp/api/users/me HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "id": "text",
  "firstName": "text",
  "lastName": "text",
  "email": "text",
  "role": "owner",
  "teams": [
    "text"
  ],
  "authData": {},
  "actualEmail": "[email protected]"
}

Delete a user from a team

delete

Removes a user from a team or from all teams. This endpoint: - Removes the user's team membership(s) - Revokes access to team resources - Optionally removes from all teams if no team is specified - Does not delete the user account itself (user can still log in but won't have team access)

    Only users with owner role can delete users. Users cannot delete themselves. If removing from all teams, the user effectively loses all access to the system.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

emailstringRequired

Email address of the user to remove

Example: [email protected]

teamstringOptional

Team identifier (slug) to remove the user from. If not provided, user will be removed from all teams.

Example: engineering

Responses

200

User deleted successfully

application/json

successbooleanRequired

Whether the operation was successful

emailstringOptional

Email address of the user that was removed

teamstringOptional

Team identifier (slug) the user was removed from

userIdstringOptional

User ID that was removed

teamAccountIdstringOptional

Team account ID the user was removed from

errorstringOptional

Error message if operation failed

400

Bad request

application/json

401

Unauthorized

application/json

403

Forbidden - Requires role: owner

delete

/sfp/api/users

DELETE /sfp/api/users HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 53

{
  "email": "[email protected]",
  "team": "engineering"
}

{
  "success": true,
  "email": "text",
  "team": "text",
  "userId": "text",
  "teamAccountId": "text",
  "error": "text"
}

Create a new user in a team

post

Creates a new user account and adds them to the specified team. This endpoint: - Creates the user in the authentication system - Assigns the specified role (owner, member, or application) - Associates the user with the team - Sends a welcome email with login instructions

    Only users with owner role can create new users. The email must be unique across the system. If the user already exists in another team, they will be added to the specified team with the given role.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

firstNamestringRequired

First name of the user

Example: John

lastNamestringRequired

Last name of the user

Example: Doe

emailstringRequired

Email address of the user

Example: [email protected]

teamstringRequired

Team identifier (slug) to add the user to

Example: engineering

rolestring · enumRequired

Role of the user in the team

Default: memberPossible values:

Responses

201

User created successfully

application/json

400

Bad request

application/json

401

Unauthorized

application/json

403

Forbidden - Requires role: owner

post

/sfp/api/users

POST /sfp/api/users HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 105

{
  "firstName": "John",
  "lastName": "Doe",
  "email": "[email protected]",
  "team": "engineering",
  "role": "member"
}

{
  "success": true,
  "userId": "text",
  "teamAccountId": "text",
  "firstName": "text",
  "lastName": "text",
  "email": "text",
  "team": "text",
  "role": "owner",
  "isExistingUser": true,
  "error": "text"
}

Good morning

hashtagGet user by email

hashtagUpdate user details

hashtagList users or lookup by GitHub username/email

hashtagGet current user profile

hashtagDelete a user from a team

hashtagCreate a new user in a team

Get user by email

Update user details

List users or lookup by GitHub username/email

Get current user profile

Delete a user from a team

Create a new user in a team