Skip to content

User

Application user entity. Users are authentication and authorization objects.

Endpoints

Method URL
GET /user/<user>
POST /user
PUT /user/<user>
DELETE /user/<user>

GET /user/<user>

Payload: No payload.

Returns: The user (password field returns the hash, not the plaintext password).

Example:

curl -u "username:api_key" -H "Accept: application/json" \
  https://app.duo.pt/user/{user_id}

Response:

{
  "success": true,
  "data": {
    "user": {
      "id": 1,
      "username": "user@example.com",
      "smtp_server": 1,
      "sms_server": 1,
      "parent": 522,
      "limit_contacts": 1000,
      "limit_monthly_emails": 1000,
      "limit_monthly_sms": 1000
    },
    "month_delta": 0
  }
}

POST /user

Parameter Type Description
username string Username (email address)
password_hash string The user's password (plaintext on POST/PUT)
parent int User ID of the parent user
smtp_server int ID of the SMTP server for this user
sms_server int ID of the SMS server for this user
limit_contacts int Maximum contacts allowed across this user's lists
limit_monthly_emails int Maximum email messages per calendar month
limit_monthly_sms int Maximum SMS per calendar month

Returns: The new user.

Warning

The three limit_* fields use -1 as the "no limit" sentinel — this is what the web application sends for Unlimited. Submitting an empty value stores 0, not null: limit_contacts=0 blocks contact creation and limit_monthly_emails=0 / limit_monthly_sms=0 disable sending on that channel. When editing a user, resend -1 for every limit you want to keep unlimited.

An empty password_hash on PUT preserves the current password.

PUT /user/<user>

Same payload as POST.

Note

This route does not accept the native PUT HTTP verb (it returns Requested URL not found … for HTTP verb PUT). Send a POST to /user/<user> with an additional form field x-verb=PUT — this is what the web application does.

Returns: The edited user.

DELETE /user/<user>

Payload: No payload.

Returns: The deleted user.