Account-side user management and self-service profile (bearer token).
Account-side user management and self-service profile (bearer token). Account company-admins add (POST user/add) and edit (POST user/edit) account users with per-store assignments and default reports, fetch a single user (POST user/get), and delete a user (DELETE users/delete). Any authenticated user updates their own profile via POST users/profile/update. No throttle; scope enforced via authorize + an ownership check.
Prerequisites
- A bearer token in the
Authorizationheader. Any endpoint that needs no token says so on its own page. - The id of each record the call targets. Every endpoint page lists the ids it needs.
Errors
| Status | Meaning |
|---|---|
401 | The bearer token is missing, expired or invalid |
403 | The token is valid but the record sits outside your account |
422 | The request failed validation — the response names the fields |
500 | Unexpected server error |
Individual endpoints may return more; each page lists its own.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
POST | Add account user | Create a new user under the authenticated account with a role (admin / location_assign / basic), optional per-store assignments and default reports (activity, review-response, insight). |
POST | Edit account user | Update an existing account user's name/title, role, store assignments, optional password and deactivation date. |
POST | Get account user | Returns a single user's profile, derived user_type, role, assigned locations (as {value,label} options) and assigned accounts. |
DELETE | Delete user | Soft-delete a user (and their person), anonymises the email, revokes any live tokens (SOC 2 CC6.2) and removes the user's email reports. |
POST | Update own profile | Update the currently authenticated user's own profile — name, phone, title, email and optional password. |