11.6REST API reference

Last updated 9 October 2026

The operations in this chapter are also available over the REST API (see Chapter 15, REST API for integrators). Routes are relative to the surface (/api for machine credentials, /rest for the console).

Method and route	Purpose	Permission
`GET /users`, `GET /users/{id}`	List or read platform users	`users:list`, `users:read`
`POST /users`	Create a user (with `password` or `sendPasswordSetupEmail: true`)	`users:create`
`PUT /users/{id}`	Edit a user	`users:update`
`POST /users/{id}/reset-password`	Set a new password	`users:update`
`POST /users/{id}/password-setup-link`	Resend the setup link	`users:update`
`POST /users/{id}/deactivate`, `/activate`	Deactivate or reactivate	`users:update`
`DELETE /users/{id}`	Delete a user	`users:delete`
`GET /users/{id}/sessions`	List a user's sign-in sessions (system scope)	`users:read`
`GET /users/{id}/windows-link`	Read a user's Windows account link	`users:read`
`GET /users/windows-accounts`	Search Active Directory accounts to link	`users:update`
`PUT /users/{id}/windows-link`	Link a Windows account (console only)	`users:update`
`DELETE /users/{id}/windows-link`	Remove a Windows account link	`users:update`
`POST /users/{id}/two-factor/reset`	Reset two-factor sign-in (console only)	`users:update`
`GET /roles`, `GET /roles/{id}`	List or read roles	`roles:list`
`GET /roles/templates`	List role templates	`roles:create`
`POST /roles`, `POST /roles/{id}/copy`	Create or copy a role	`roles:create`
`PUT /roles/{id}`	Update a role	`roles:update`
`PUT /roles/{id}/two-factor-requirement`	Require two-factor sign-in (console only)	`roles:update`
`DELETE /roles/{id}`	Delete a role	`roles:delete`
`GET /permissions`	List all permissions	`permissions:list`

Changes to users and roles are always recorded in the operations log, and cannot be switched off from Directory Policies.

Last updated 9 October 2026