Users

List users or lookup by GitHub username/email

GET/sfp/api/users

Three modes of operation:

    **Lookup by GitHub** (when lookup=github):    - Resolves a GitHub username to user profile    - Use: GET /users?lookup=github&id=<username>    - Returns full user profile or 404 if not found        **Lookup by Email** (when lookup=email):    - Looks up user by email address    - Use: GET /users?lookup=email&id=<email>    - Returns full user profile or 404 if not found        **List mode** (default):    - Retrieves a paginated list of users    - Can filter by team (using team slug) or role    - Returns user details including email, role, team memberships

Authorization

access-token

AuthorizationBearer <token>

In: header

Query Parameters

lookup?string

Lookup mode

Value in

"github"
"email"

id?string

Identifier for lookup (GitHub username or email)

team?string

Team slug to filter by

limit?number

Number of records to return

offset?number

Number of records to skip

role?string

Filter by role

Value in

"owner"
"member"

`application/json`

curl -X GET "https://example.com/sfp/api/users"

{  "id": "string",  "firstName": "string",  "lastName": "string",  "email": "string",  "role": "owner",  "teams": [    "string"  ],  "authData": {}}

Creates a new user account and adds them to the specified team. This endpoint: - Creates the user in the authentication system - Assigns the specified role (owner, member, or application) - Associates the user with the team - flxbl cloud: sends a sign-in email through the global auth service (never fails the request; see inviteSent/warnings)

    Only users with owner role can create new users. The email must be unique across the system. If the user already exists in another team, they will be added to the specified team with the given role.

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

firstName*string

First name of the user

lastName*string

Last name of the user

email*string

Email address of the user

team*string

Team identifier (slug) to add the user to

role*string

Role of the user in the team

Default"member"

Value in

"owner"
"member"

ssoProviderId?string

SSO provider ID override (format: sso:). If not provided, falls back to AUTH_SSO_PROVIDER_ID env var. When set, the user is created as an SSO user instead of email/password.

Response Body

`application/json`

curl -X POST "https://example.com/sfp/api/users" \  -H "Content-Type: application/json" \  -d '{    "firstName": "John",    "lastName": "Doe",    "email": "john.doe@example.com",    "team": "engineering",    "role": "owner"  }'

{  "success": true,  "userId": "string",  "teamAccountId": "string",  "firstName": "string",  "lastName": "string",  "email": "string",  "team": "string",  "role": "owner",  "isExistingUser": true,  "inviteSent": true,  "warnings": [    "string"  ],  "error": "string"}

Delete a user from a team

DELETE/sfp/api/users

Removes a user from a team or from all teams. This endpoint: - Removes the user's team membership(s) - Revokes access to team resources - Optionally removes from all teams if no team is specified - Does not delete the user account itself (user can still log in but won't have team access)

    Only users with owner role can delete users. Users cannot delete themselves. If removing from all teams, the user effectively loses all access to the system.

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

email*string

Email address of the user to remove

team?string

Team identifier (slug) to remove the user from. If not provided, user will be removed from all teams.

Response Body

`application/json`

curl -X DELETE "https://example.com/sfp/api/users" \  -H "Content-Type: application/json" \  -d '{    "email": "john.doe@example.com"  }'

{  "success": true,  "email": "string",  "team": "string",  "userId": "string",  "teamAccountId": "string",  "error": "string"}

Get current user profile

GET/sfp/api/users/me

Retrieves the complete profile of the currently authenticated user. Returns: - User identification (ID, email) - Account details and role - Team memberships - Authentication metadata (first name, last name) - JWT token information if available

    This endpoint is useful for applications to understand the current user's permissions and profile after authentication.

Authorization

access-token

AuthorizationBearer <token>

In: header

Response Body

`application/json`

curl -X GET "https://example.com/sfp/api/users/me"

{  "id": "string",  "firstName": "string",  "lastName": "string",  "email": "string",  "role": "owner",  "teams": [    "string"  ],  "authData": {}}

Get user by email

GET/sfp/api/users/{email}

Retrieves detailed information about a specific user by their email address.

    Access control:    - Self-lookup: Users can always retrieve their own full profile    - Owner lookup: Owners can view other users but receive limited data (no sensitive auth metadata)    - Team-specific lookup: Optionally filter by team using the team slug parameter        Returns user profile including account details, team memberships, and appropriate metadata based on access level.

Authorization

access-token

AuthorizationBearer <token>

In: header

Path Parameters

email*string

User email

Query Parameters

team?string

Team slug (optional for self-lookups)

Response Body

`application/json`

curl -X GET "https://example.com/sfp/api/users/string"

{  "id": "string",  "firstName": "string",  "lastName": "string",  "email": "string",  "role": "owner",  "teams": [    "string"  ],  "authData": {}}

Update user details

PUT/sfp/api/users/{email}

Updates user profile information. Users can update: - Their own profile (self-update) - Other users' profiles if they have owner role

    Updatable fields include:    - User metadata (first name, last name)    - Role assignments within teams    - Team associations        The endpoint validates permissions and ensures users cannot escalate their own privileges. Returns the updated user profile on success.

Authorization

access-token

AuthorizationBearer <token>

In: header

Path Parameters

email*string

User email

Query Parameters

team?string

Team slug (optional)

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

firstName?string

First name of the user

lastName?string

Last name of the user

role?string

Role of the user in the team

Value in

"owner"
"member"

Response Body

`application/json`

curl -X PUT "https://example.com/sfp/api/users/string" \  -H "Content-Type: application/json" \  -d '{}'

{  "success": true,  "user": {    "id": "string",    "firstName": "string",    "lastName": "string",    "email": "string",    "role": "owner",    "teams": [      "string"    ],    "authData": {}  },  "error": "string"}

POST/sfp/api/users/{email}/invite

Re-triggers the sign-in email for an existing member of this tenant. The mail is sent by the global auth service through its public OTP endpoint and tells the user how to open codev and sign in (GitHub / Azure DevOps / SSO with this email, or set a password for email sign-in). Only owners can trigger it. Returns success=false with a reason (e.g. rate limited) when the mail could not be sent. Not available on self-hosted servers.

Authorization

access-token

AuthorizationBearer <token>

In: header

Path Parameters

email*string

Email of the member to send the sign-in email to

Response Body

`application/json`

curl -X POST "https://example.com/sfp/api/users/string/invite"

{  "success": true,  "email": "string",  "error": "string"}

Refresh an OAuth provider token

POST/sfp/api/users/refresh-provider-token

Exchanges a provider refresh token for a fresh access token.

    Supabase Auth does not automatically refresh OAuth provider tokens (GitHub, Azure DevOps).    This endpoint uses the server's OAuth app credentials to call the provider's token refresh    endpoint, returning a fresh access token to the caller.    - **GitHub**: Uses the login OAuth app credentials    - **Azure DevOps**: Uses the Azure login OAuth app credentials configured for Supabase/GoTrue sign-in, not the service principal integration

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

provider*string

OAuth provider whose token should be refreshed

Value in

"github"
"azuredevops"

refresh_token*string

The provider refresh token obtained during OAuth login

Response Body

`application/json`

curl -X POST "https://example.com/sfp/api/users/refresh-provider-token" \  -H "Content-Type: application/json" \  -d '{    "provider": "github",    "refresh_token": "ghr_xxxxxxxxxxxxxxxxxxxx"  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "token_type": "string"}

200application/json

400

401

403

404

201application/json

400application/json

401application/json

403

200application/json

400application/json

401application/json

403

200application/json

401

403

200application/json

400

401

403

404

200application/json

400

401

404

201application/json

400

401

403

200application/json

400

401

403

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`