Users API

8 endpoints.

Method	Path	Summary
`GET`	`/api/users`	Get all users (requires VIEW_USERS permission)
`POST`	`/api/users`	Create new user (requires CREATE_USER permission)
`DELETE`	`/api/users/{userId}`	Delete user (requires DELETE_USER permission)
`GET`	`/api/users/{userId}`	Get user by ID (requires VIEW_USERS permission)
`PUT`	`/api/users/{userId}`	Update user (requires UPDATE_USER permission)
`PUT`	`/api/users/{userId}/role`	Update user role (requires MANAGE_MEMBERS permission)
`PUT`	`/api/users/{userId}/status`	Toggle user status (requires UPDATE_USER permission)
`PUT`	`/api/users/profile`	Update current user's own profile

Get all users (requires VIEW_USERS permission)

GET /api/users

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`page`	query	no	integer	—
`limit`	query	no	integer	—
`search`	query	no	string	—

Responses

Status	Description	Body
`200`	Paginated list of users	—
`403`	Permission denied	—

Create new user (requires CREATE_USER permission)

POST /api/users

Auth: Bearer JWT required.

Request body (required) — application/json

Field	Type	Required	Description
`email`	string (email)	yes	—
`firstName`	string	yes	—
`familyName`	string	yes	—
`password`	string	no	—

Responses

Status	Description	Body
`201`	User created successfully	—
`403`	Permission denied	—

Delete user (requires DELETE_USER permission)

DELETE /api/users/{userId}

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`userId`	path	yes	string (uuid)	—

Responses

Status	Description	Body
`200`	User deleted successfully	—
`403`	Permission denied	—

Get user by ID (requires VIEW_USERS permission)

GET /api/users/{userId}

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`userId`	path	yes	string (uuid)	—

Responses

Status	Description	Body
`200`	User details	—
`403`	Permission denied	—
`404`	User not found	—

Update user (requires UPDATE_USER permission)

PUT /api/users/{userId}

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`userId`	path	yes	string (uuid)	—

Request body — application/json

Field	Type	Required	Description
`firstName`	string	no	—
`familyName`	string	no	—
`email`	string (email)	no	—

Responses

Status	Description	Body
`200`	User updated successfully	—
`403`	Permission denied	—

Update user role (requires MANAGE_MEMBERS permission)

PUT /api/users/{userId}/role

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`userId`	path	yes	string (uuid)	—

Request body (required) — application/json

Field	Type	Required	Description
`role`	enum: `ADMIN`, `MODERATOR`, `MEMBER`	yes	—

Responses

Status	Description	Body
`200`	Role updated successfully	—
`403`	Permission denied	—

Toggle user status (requires UPDATE_USER permission)

PUT /api/users/{userId}/status

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`userId`	path	yes	string (uuid)	—

Responses

Status	Description	Body
`200`	User status toggled successfully	—
`403`	Permission denied	—

Update current user's own profile

PUT /api/users/profile

Auth: Bearer JWT required.

Request body — multipart/form-data

Field	Type	Required	Description
`firstName`	string	no	—
`familyName`	string	no	—
`avatar`	string (binary)	no	—

Responses

Status	Description	Body
`200`	Profile updated successfully	—
`401`	Authentication required	—