FusionAuth User API
The User API from FusionAuth — 29 operation(s) for user.
FusionAuth User API is one of 37 APIs that FusionAuth publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include User. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.
This API exposes 55 operations across 29 paths, and defines 81 schemas. It is described by OpenAPI 3.2.0, at version 1.66.0.
Requests are made against 2 base URLs: http://localhost:9011, https://sandbox.fusionauth.io.
55 operations
29 paths
81 schemas
7 DELETE16 GET3 PATCH22 POST7 PUT
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 2
FusionAuth User API declares
2 security schemes
for authenticating requests.
An API key is passed in the header as Authorization (ApiKeyAuth).
It accepts HTTP bearer tokens (JWT) (BearerAuth).
By default, every request must be authenticated.
Paths & Operations 55
Across 29 paths, the API surfaces 55 operations — 7 DELETE, 16 GET, 3 PATCH, 22 POST, 7 PUT. Each is listed below with its method, path, parameters, and response codes.
User 55
POST
/api/user
Creates a user. You can optionally specify an Id for the user, if not provided one will be generated.
GET
/api/user
Retrieves the user by a verificationId. The intended use of this API is to retrieve a user after the forgot password workflow has been initiated and you may not know the user's email or username. OR…
POST
/api/user/action
Takes an action on a user. The user being actioned is called the "actionee" and the user taking the action is called the "actioner". Both user ids are required in the request object.
GET
/api/user/action
Retrieves all the actions for the user with the given Id that are currently inactive. An inactive action means one that is time based and has been canceled or has expired, or is not time based. OR Re…
DELETE
/api/user/action/{actionId}
Cancels the user action.
PUT
/api/user/action/{actionId}
Modifies a temporal user action by changing the expiration of the action and optionally adding a comment to the action.
GET
/api/user/action/{actionId}
Retrieves a single action log (the log of a user action that was taken on a user previously) for the given Id.
DELETE
/api/user/bulk
Deletes the users with the given Ids, or users matching the provided JSON query or queryString. The order of preference is Ids, query and then queryString, it is recommended to only provide one of th…
POST
/api/user/change-password
Changes a user's password using their access token (JWT) instead of the changePasswordId A common use case for this method will be if you want to allow the user to change their own password. Remember…
GET
/api/user/change-password
Check to see if the user must obtain a Trust Request Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Pas…
POST
/api/user/change-password/{changePasswordId}
Changes a user's password using the change password Id. This usually occurs after an email has been sent to the user and they clicked on a link to reset their password. As of version 1.32.2, prefer s…
GET
/api/user/change-password/{changePasswordId}
Check to see if the user must obtain a Trust Token Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Passw…
POST
/api/user/comment
Adds a comment to the user's account.
POST
/api/user/comment/search
Searches user comments with the specified criteria and pagination.
GET
/api/user/comment/{userId}
Retrieves all the comments for the user with the given Id.
POST
/api/user/consent
Creates a single User consent.
GET
/api/user/consent
Retrieves all the consents for a User.
POST
/api/user/consent/{userConsentId}
Creates a single User consent.
PATCH
/api/user/consent/{userConsentId}
Updates, via PATCH, a single User consent by Id.
GET
/api/user/consent/{userConsentId}
Retrieve a single User consent by Id.
DELETE
/api/user/consent/{userConsentId}
Revokes a single User consent by Id.
PUT
/api/user/consent/{userConsentId}
Updates a single User consent by Id.
POST
/api/user/family
Creates a family with the user Id in the request as the owner and sole member of the family. You can optionally specify an Id for the family, if not provided one will be generated.
GET
/api/user/family
Retrieves all the families that a user belongs to.
GET
/api/user/family/pending
Retrieves all the children for the given parent email address.
POST
/api/user/family/request
Sends out an email to a parent that they need to register and create a family or need to log in and add a child to their existing family.
PUT
/api/user/family/{familyId}
Updates a family with a given Id. OR Adds a user to an existing family. The family Id must be specified.
POST
/api/user/family/{familyId}
Creates a family with the user Id in the request as the owner and sole member of the family. You can optionally specify an Id for the family, if not provided one will be generated.
GET
/api/user/family/{familyId}
Retrieves all the members of a family by the unique Family Id.
DELETE
/api/user/family/{familyId}/{userId}
Removes a user from the family with the given Id.
POST
/api/user/forgot-password
Begins the forgot password sequence, which kicks off an email to the user so that they can reset their password.
POST
/api/user/import
Bulk imports users. This request performs minimal validation and runs batch inserts of users with the expectation that each user does not yet exist and each registration corresponds to an existing Fu…
GET
/api/user/recent-login
Retrieves the last number of login records for a user. OR Retrieves the last number of login records.
POST
/api/user/refresh-token/import
Bulk imports refresh tokens. This request performs minimal validation and runs batch inserts of refresh tokens with the expectation that each token represents a user that already exists and is regist…
POST
/api/user/registration
Registers a user for an application. If you provide the User and the UserRegistration object on this request, it will create the user as well as register them for the application. This is called a Fu…
PATCH
/api/user/registration/{userId}
Updates, via PATCH, the registration for the user with the given Id and the application defined in the request.
POST
/api/user/registration/{userId}
Registers a user for an application. If you provide the User and the UserRegistration object on this request, it will create the user as well as register them for the application. This is called a Fu…
PUT
/api/user/registration/{userId}
Updates the registration for the user with the given Id and the application defined in the request.
DELETE
/api/user/registration/{userId}/{applicationId}
Deletes the user registration for the given user and application along with the given JSON body that contains the event information. OR Deletes the user registration for the given user and applicatio…
GET
/api/user/registration/{userId}/{applicationId}
Retrieves the user registration for the user with the given Id and the given application Id.
GET
/api/user/search
Retrieves the users for the given Ids. If any Id is invalid, it is ignored.
POST
/api/user/search
Retrieves the users for the given search criteria and pagination.
POST
/api/user/two-factor/recovery-code/{userId}
Generate two-factor recovery codes for a user. Generating two-factor recovery codes will invalidate any existing recovery codes.
GET
/api/user/two-factor/recovery-code/{userId}
Retrieve two-factor recovery codes for a user.
DELETE
/api/user/two-factor/{userId}
Disable two-factor authentication for a user using a JSON body rather than URL parameters. OR Disable two-factor authentication for a user.
POST
/api/user/two-factor/{userId}
Enable two-factor authentication for a user.
PUT
/api/user/verify-email
Re-sends the verification email to the user. If the Application has configured a specific email template this will be used instead of the tenant configuration. OR Re-sends the verification email to t…
POST
/api/user/verify-email
Administratively verify a user's email address. Use this method to bypass email verification for the user. The request body will contain the userId to be verified. An API key is required when sending…
PUT
/api/user/verify-registration
Re-sends the application registration verification email to the user. OR Generate a new Application Registration Verification Id to be used with the Verify Registration API. This API will not attempt…
POST
/api/user/verify-registration
Confirms a user's registration. The request body will contain the verificationId. You may also be required to send a one-time use code based upon your configuration. When the application is configure…
POST
/api/user/{userId}
Creates a user. You can optionally specify an Id for the user, if not provided one will be generated.
DELETE
/api/user/{userId}
Deletes the user based on the given request (sent to the API as JSON). This permanently deletes all information, metrics, reports and data associated with the user. OR Deletes the user for the given…
PATCH
/api/user/{userId}
Updates, via PATCH, the user with the given Id.
PUT
/api/user/{userId}
Updates the user with the given Id. OR Reactivates the user with the given Id.
GET
/api/user/{userId}
Retrieves the user for the given Id.
Schemas 81
The contract defines 81 schemas that model the data the API accepts and returns. The most detailed are User (40 properties), UserActionLog (19 properties), UserRegistration (16 properties), Consent (11 properties). Each schema is shown below with its type and property counts.
ImportRequest
object
Import request.
5 properties
UserResponse
object
User API response object.
8 properties
MetaData
object
3 properties
TwoFactorRequest
object
10 properties
BreachedPasswordStatus
string
UserCommentResponse
object
User Comment Response
2 properties
DeviceInfo
object
5 properties
LogHistory
object
A historical state of a user log event. Since events can be modified, this stores the historical state.
1 property
FamilyRole
string
FamilyMember
object
Models a single family member.
6 properties
FamilyRequest
object
API request for managing families and members.
1 property
EventInfo
object
Information about a user event (login, register, etc) that helps identify the source of the event (location, device type, OS, etc).
8 properties
ForgotPasswordRequest
object
Forgot password request object.
10 properties
VerifyEmailResponse
object
2 properties
ForgotPasswordResponse
object
Forgot password response object.
1 property
IdentityType
object
Model identity types provided by FusionAuth.
1 property
UserDeleteRequest
object
User API delete request object.
7 properties
UserTwoFactorConfiguration
object
2 properties
VerificationId
object
4 properties
UserConsentRequest
object
API response for User consent.
1 property
VerifyRegistrationResponse
object
2 properties
TwoFactorDisableRequest
object
4 properties
GroupMember
object
A User's membership into a Group
5 properties
UserCommentSearchRequest
object
Search request for user comments
1 property
UserActionLog
object
A log for an action that was taken on a User.
19 properties
SearchRequest
object
Search API request.
2 properties
Locale
string
A Locale object represents a specific geographical, political, or cultural region.
UserCommentSearchCriteria
object
Search criteria for user comments.
7 properties
ZoneId
string
Timezone Identifier
LocalDate
string
A date without a time-zone in the ISO-8601 calendar system, such as 2007-12-03.
UserConsentResponse
object
API response for User consent.
2 properties
VerifyEmailRequest
object
4 properties
FamilyEmailRequest
object
API request for sending out family requests to parent's.
1 property
Error
object
Defines an error.
3 properties
IdentityVerifiedReason
string
Models the reason that {@link UserIdentityverified} was set to true or false.
RecentLoginResponse
object
Response for the user login report.
1 property
Errors
object
Standard error domain object that can also be used as the response from an API call.
2 properties
User
object
The public, global view of a User. This object contains all global information about the user including birthdate, registration information preferred languages…
40 properties
EmailPlus
object
4 properties
UserRegistration
object
User registration information for a single application.
16 properties
ActionData
object
10 properties
ConsentStatus
string
Models a consent.
SendSetPasswordIdentityType
string
Used to indicate which identity type a password "request" might go to. It could be used for send set passwords or send password resets.
Location
object
Location information. Useful for IP addresses and other displayable data objects.
7 properties
PendingResponse
object
1 property
UserRequest
object
User API request object.
9 properties
UserComment
object
A log for an event that happened to a User.
5 properties
ChangePasswordRequest
object
Change password request object.
10 properties
ZonedDateTime
integer
The number of milliseconds since the unix epoch: January 1, 1970 00:00:00 UTC. This value is always in UTC.
UserIdentity
object
11 properties
HistoryItem
object
4 properties
Sort
string
RefreshToken
object
Models a JWT Refresh Token.
9 properties
TwoFactorRecoveryCodeResponse
object
1 property
TOTPAlgorithm
string
UserSearchCriteria
object
This class is the user query. It provides a build pattern as well as public fields for use on forms and in actions.
6 properties
RegistrationDeleteRequest
object
Registration delete API request object.
1 property
FamilyResponse
object
API response for managing families and members.
2 properties
SortField
object
3 properties
UserDeleteResponse
object
User API bulk response object.
4 properties
TwoFactorMethod
object
7 properties
DisplayableRawLogin
object
A displayable raw login that includes application name and user loginId.
8 properties
ContentStatus
string
Status for content like usernames, profile attributes, etc.
RegistrationRequest
object
Registration API request object.
10 properties
Consent
object
Models a consent.
11 properties
SearchResponse
object
Search API response.
4 properties
RegistrationResponse
object
Registration API request object.
9 properties
ChangePasswordResponse
object
Change password response object.
2 properties
Family
object
Models a family grouping of users.
4 properties
UserConsent
object
Models a User consent.
10 properties
TwoFactorResponse
object
2 properties
UserDeleteSingleRequest
object
User API delete request object for a single user.
2 properties
ActionResponse
object
The user action response object.
2 properties
UserCommentSearchResponse
object
User comment search response
2 properties
RefreshTokenImportRequest
object
Refresh Token Import request.
2 properties
AuthenticatorConfiguration
object
3 properties
LocalizedIntegers
object
Models a set of localized Integers that can be stored as JSON.
ChangePasswordReason
string
VerifyRegistrationRequest
object
3 properties
ActionRequest
object
The user action request object.
3 properties
UserCommentRequest
object
1 property
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from FusionAuth 12
Other APIs FusionAuth publishes across the network.
FusionAuth Api Key API
FusionAuth Application API
FusionAuth Connector API
FusionAuth Consent API
FusionAuth Email API
FusionAuth Entity API
FusionAuth Form API
FusionAuth Group API
FusionAuth Health API
FusionAuth Identity API
FusionAuth Identity Provider API
FusionAuth Integration API
#User
Where this information came from
This is an independent, third-party profile of FusionAuth User API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.