User
Query and manage identity-provider users, roles, credentials, locale, and live sessions. An active realm is enabled and its activation time has been reached. Superusers bypass realm activity and cross-realm restrictions; endpoint-specific role requirements still apply.
Update the current user's locale
Stores the supplied non-empty locale string as the caller's identity-provider locale attribute. The target realm must be active unless the caller is a superuser.
Query users based on criteria
Executes a UserQuery. Non-super users are forced into their authenticated realm and cannot see system accounts; callers with read-users but not read-admin receive basic fields only. The target realm must be active unless the caller is a superuser.
Request a password reset for the current user
Initiates the identity provider's configured password-reset action for the caller's own account. The target realm must be active unless the caller is a superuser.
Update the current user's password
Replaces the caller's own identity-provider credential using the supplied credential representation. The target realm must be active unless the caller is a superuser.
Update the currently authenticated user
Updates the caller's own profile. A supplied user ID must match the access token; role and realm administration are not provided by this endpoint. The target realm must be active unless the caller is a superuser.
Retrieve the currently authenticated user
Returns the identity-provider record corresponding to the current access token. The target realm must be active unless the caller is a superuser.
Retrieve the current user's realm roles
Returns realm-level role names assigned to the caller. The target realm must be active unless the caller is a superuser.
Retrieve the current user's client roles
Returns role names assigned to the caller for the named identity-provider client. The target realm must be active unless the caller is a superuser.
Disconnect a user session
Terminates the active MQTT connection identified by sessionID. The realm must match the session owner's realm. Authenticated users may disconnect their own sessions without an additional client role. Disconnecting another user's session requires the openremote client role write:admin or superuser status. Non-superusers are limited to their own active realm; superusers may disconnect sessions across realms, including inactive realms.
Request a password reset for a user in a realm
Asks the identity provider to send or initiate its configured password-reset action for the specified user. The target realm must be active unless the caller is a superuser.
Update the password for a user in a realm
Replaces a user's credential in an administered realm using the supplied credential representation. The target realm must be active unless the caller is a superuser.
Reset the secret for a user in a realm
Generates and returns a new client secret for a service user in an administered realm. The target realm must be active unless the caller is a superuser.
Update OpenRemote client roles for a realm
Creates, updates, or removes role definitions for the default OpenRemote client in the requested realm. The target realm must be active unless the caller is a superuser.
Retrieve a user's realm roles
Returns realm-level role names assigned to one user. Without read-admin permission, callers may retrieve only their own roles. The target realm must be active unless the caller is a superuser.
Update a user's realm roles
Replaces the user's assigned realm-level role names in an administered realm. The target realm must be active unless the caller is a superuser.
Retrieve a user's client roles
Returns role names assigned to one user for the named client. Without read-admin permission, callers may retrieve only their own roles. The target realm must be active unless the caller is a superuser.
Update a user's client roles
Replaces the user's assigned role names for the named client in an administered realm. The target realm must be active unless the caller is a superuser.
Retrieve live sessions for a user
Returns active MQTT sessions for one user, including connection ID, creation time, and remote address. Without read-admin permission, callers may inspect only themselves. The target realm must be active unless the caller is a superuser.
Create a new user in a realm
Creates an identity-provider user in a realm administered by the caller and returns the resulting user record. The target realm must be active unless the caller is a superuser.
Update a user in a realm
Updates an existing identity-provider user in an administered realm. The master administrator cannot be disabled. The target realm must be active unless the caller is a superuser.
Delete a user from a realm
Permanently deletes a user from an administered realm. The master-realm administrator cannot be deleted. The target realm must be active unless the caller is a superuser.
Retrieve client roles for a realm and client
Returns all role definitions exposed by the named identity-provider client. Realm-administrator access is required. The target realm must be active unless the caller is a superuser.
Update client roles for a realm and client
Creates, updates, or removes role definitions for a named identity-provider client. The target realm must be active unless the caller is a superuser.
Retrieve a user in a realm
Returns one user when it belongs to the requested accessible realm. Without read-admin permission, callers may retrieve only their own user. The target realm must be active unless the caller is a superuser.