GET /v1/dashboard/accounts/:accountId/instances/:instanceId/users

Search users by email, name or id, filtered by banned, MFA or provider.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users

Create a user with a verified email and an optional password. Owner or admin.

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId

Full user profile for an administrator, including private metadata.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/ban

Ban a user and revoke every session they hold.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/unban

Lift a ban. Sessions are not restored.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/unlock

Clear an automated lockout for a user locked out by guessing.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/reset_mfa

Remove every second factor. Requires owner or admin.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/revoke_sessions

Sign a user out everywhere and bump sessions_version.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/sessions/:sessionId/revoke

Revoke one of a user’s sessions (per-device sign-out).

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/impersonate

Mint a single-use impersonation token. Audited by person.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/delete

Soft-delete a user. PII is scrubbed after 30 days.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/users/:userId/metadata

Edit the public, private and unsafe metadata bags. Refuses non-objects, prototype-polluting keys, oversized and over-nested documents.