Create a new user for a given database or passwordless connection.

Note: connection is required but other parameters such as email and password are dependent upon the type of connection.

Delete a user by user ID. This action cannot be undone. For Auth0 Dashboard instructions, see Delete Users.

Retrieve details of users. It is possible to:

• Specify a search criteria for users
• Sort the users to be returned
• Select the fields to be returned
• Specify the number of users to retrieve per page and the page index The q query parameter can be used to get users that match the specified criteria using query string syntax.

Learn more about searching for users.

Read about best practices when working with the API endpoints for retrieving users.

Auth0 limits the number of users you can return. If you exceed this threshold, please redefine your search, use the export job, or the User Import / Export extension.

Remove an existing multi-factor authentication (MFA) recovery code and generate a new one. If a user cannot access the original device or account used for MFA enrollment, they can use a recovery code to authenticate.

Retrieve user details. A list of fields to include or exclude may also be specified. For more information, see Retrieve Users with the Get Users Endpoint.

Update a user.

These are the attributes that can be updated at the root level:

• app_metadata
• blocked
• email
• email_verified
• family_name
• given_name
• name
• nickname
• password
• phone_number
• phone_verified
• picture
• username
• user_metadata
• verify_email

Some considerations:

• The properties of the new object will replace the old ones.
• The metadata fields are an exception to this rule (user_metadata and app_metadata). These properties are merged instead of being replaced but be careful, the merge only occurs on the first level.
• If you are updating email, email_verified, phone_number, phone_verified, username or password of a secondary identity, you need to specify the connection property too.
• If you are updating email or phone_number you can specify, optionally, the client_id property.
• Updating email_verified is not supported for enterprise and passwordless sms connections.
• Updating the blocked to false does not affect the user's blocked state from an excessive amount of incorrectly provided credentials. Use the "Unblock a user" endpoint from the "User Blocks" API to change the user's state.
• Supported attributes can be unset by supplying null as the value.

Updating a field (non-metadata property)

To mark the email address of a user as verified, the body to send should be:

{ "email_verified": true }

Updating a user metadata root property

Let's assume that our test user has the following user_metadata:

{ "user_metadata" : { "profileCode": 1479 } }

To add the field addresses the body to send should be:

{ "user_metadata" : { "addresses": {"work_address": "100 Industrial Way"} }}

The modified object ends up with the following user_metadata property:

{
  "user_metadata": {
    "profileCode": 1479,
    "addresses": { "work_address": "100 Industrial Way" }
  }
}

Updating an inner user metadata property

If there's existing user metadata to which we want to add "home_address": "742 Evergreen Terrace" (using the addresses property) we should send the whole addresses object. Since this is a first-level object, the object will be merged in, but its own properties will not be. The body to send should be:

{
  "user_metadata": {
    "addresses": {
      "work_address": "100 Industrial Way",
      "home_address": "742 Evergreen Terrace"
    }
  }
}

The modified object ends up with the following user_metadata property:

{
  "user_metadata": {
    "profileCode": 1479,
    "addresses": {
      "work_address": "100 Industrial Way",
      "home_address": "742 Evergreen Terrace"
    }
  }
}

Create an authentication method. Authentication methods created via this endpoint will be auto confirmed and should already have verification completed.

Remove the authentication method with the given ID from the specified user. For more information, review Manage Authentication Methods with Management API.

Retrieve detailed list of authentication methods associated with a specified user.

Get an authentication method by ID

Modify the authentication method with the given ID from the specified user. For more information, review Manage Authentication Methods with Management API.

Remove all authenticators registered to a given user ID, such as OTP, email, phone, and push-notification. This action cannot be undone. For more information, review Manage Authentication Methods with Management API.

Retrieve the first multi-factor authentication enrollment that a specific user has confirmed.

Link two user accounts together forming a primary and secondary relationship. On successful linking, the endpoint returns the new array of the primary account identities.

Note: There are two ways of invoking the endpoint:

• With the authenticated primary account's JWT in the Authorization header, which has the update:current_user_identities scope:

        POST /api/v2/users/PRIMARY_ACCOUNT_USER_ID/identities
        Authorization: "Bearer PRIMARY_ACCOUNT_JWT"
        {
          "link_with": "SECONDARY_ACCOUNT_JWT"
        }
      

  In this case, only the link_with param is required in the body, which also contains the JWT obtained upon the secondary account's authentication.
• With a token generated by the API V2 containing the update:users scope:

      POST /api/v2/users/PRIMARY_ACCOUNT_USER_ID/identities
      Authorization: "Bearer YOUR_API_V2_TOKEN"
      {
        "provider": "SECONDARY_ACCOUNT_PROVIDER",
        "connection_id": "SECONDARY_ACCOUNT_CONNECTION_ID(OPTIONAL)",
        "user_id": "SECONDARY_ACCOUNT_USER_ID"
      }
      

  In this case you need to send provider and user_id in the body. Optionally you can also send the connection_id param which is suitable for identifying a particular database connection for the 'auth0' provider.

Unlink a specific secondary account from a target user. This action requires the ID of both the target user and the secondary account.

Unlinking the secondary account removes it from the identities array of the target user and creates a new standalone profile for the secondary account. To learn more, review Unlink User Accounts.

Retrieve log events for a specific user.

Note: For more information on all possible event types, their respective acronyms and descriptions, see Log Event Type Codes.

For more information on the list of fields that can be used in sort, see Searchable Fields.

Auth0 limits the number of logs you can return by search criteria to 100 logs per request. Furthermore, you may only paginate through up to 1,000 search results. If you exceed this threshold, please redefine your search.

Remove a multifactor authentication configuration from a user's account. This forces the user to manually reconfigure the multi-factor provider.

Invalidate all remembered browsers across all authentication factors for a user.

Retrieve list of the specified user's current Organization memberships. User must be specified by user ID. For more information, review Auth0 Organizations.

Assign permissions to a user.

Remove permissions from a user.

Retrieve all permissions associated with the user.

Delete all refresh tokens for a user.

Retrieve details for a user's refresh tokens.

Assign one or more existing user roles to a user. For more information, review Role-Based Access Control.

Note: New roles cannot be created through this action. Additionally, this action is used to assign roles to a user in the context of your whole tenant. To assign roles in the context of a specific Organization, use the following endpoint: Assign user roles to an Organization member.

Retrieve detailed list of all user roles currently assigned to a user.

Note: This action retrieves all roles assigned to a user in the context of your whole tenant. To retrieve Organization-specific roles, use the following endpoint: Get user roles assigned to an Organization member.

Remove one or more specified user roles assigned to a user.

Note: This action removes a role from a user in the context of your whole tenant. If you want to unassign a role from a user in the context of a specific Organization, use the following endpoint: Delete user roles from an Organization member.

Delete all sessions for a user.

Retrieve details for a user's sessions.