# Users

Manage user accounts within an organization — from initial invitation through
ongoing profile management and access lifecycle.

- `create-invite` — send an email invitation to a new user; the invited user completes
  signup via the platform authentication flow (powered by Clerk)
- `retrieve / list-users` — inspect user profiles and organization membership
- `update-user` — modify user profile attributes
- `assign-user-role` — directly assign a [Role](#tag/Roles) to a specific user
- `disable-user` — suspend access without deleting the account
- `delete-user` — remove a user from the organization

User identity and authentication (login, SSO, MFA) are handled externally by Clerk.
These endpoints manage the platform-side user record, role assignments, and access state.


## Assign role to user

 - [POST /api/v1/user/user-assign-user-role](https://api.tenovos.com/openapi/content-intelligence/users/tenovos.authz.userservice.userassignuserrole.md): Assigns a role to a user, establishing their base permission set within the organization.

Request:
userId   - ID of the user to assign the role to.
roleId   - ID of the role to assign. The role must be of type USER_ROLE.

Response:
userId   - ID of the user the role was assigned to.
roleId   - ID of the role that was assigned.

## Get a user

 - [POST /api/v1/user/retrieve-user](https://api.tenovos.com/openapi/content-intelligence/users/tenovos.authz.userservice.retrieveuser.md): Retrieves full user profiles by their IDs, including auth provider data.

Request:
userIds   - List of user IDs to retrieve.

Response:
users      - List of User objects including email, name, role, group memberships,
last login time, profile picture URL, and enabled/invited status.

## Search users

 - [POST /api/v1/user/list-users](https://api.tenovos.com/openapi/content-intelligence/users/tenovos.authz.userservice.listusers.md): Lists users in the organization with optional search, role, and group filtering, supporting pagination.

Request:
searchQuery   - Free-text query to filter users by email or name.
roleId        - Optional role ID to return only users with that role.
groupId       - Optional group ID to return only users in that group.
pagination     - Optional Pagination cursor and page size for iterating large result sets.

Response:
users          - List of User objects matching the filter criteria.
pageCursor    - Opaque cursor for the next page. Absent when there are no further results.

## Delete a user

 - [POST /api/v1/user/delete-user](https://api.tenovos.com/openapi/content-intelligence/users/tenovos.authz.userservice.deleteuser.md): Permanently removes a user from the organization, including all group memberships and role assignments.

Request:
id   - ID of the user to permanently delete. This operation cannot be undone.

Response:
(empty)

## Disable a user

 - [POST /api/v1/user/disable-user](https://api.tenovos.com/openapi/content-intelligence/users/tenovos.authz.userservice.disableuser.md): Soft-disables one or more users, marking them as inactive while preserving their records.

Request:
userIds   - List of user IDs to disable. Disabled users have isEnabled set to false.

Response:
userIds   - List of user IDs that were successfully disabled.

## Update a user

 - [POST /api/v1/user/update-user](https://api.tenovos.com/openapi/content-intelligence/users/tenovos.authz.userservice.updateuser.md): Updates profile fields and group/role assignments for a user. All fields are optional.

Request:
userId      - ID of the user to update.
firstName   - Optional replacement first name.
lastName    - Optional replacement last name.
roleId      - Optional replacement role ID.
groupIds    - Optional replacement list of group memberships.
username     - Optional replacement username.

Response:
userId      - ID of the updated user.

## Invite a user

 - [POST /api/v1/user/create-invite](https://api.tenovos.com/openapi/content-intelligence/users/tenovos.authz.userservice.createinvite.md): Sends invitations to new users and creates their accounts with a pre-assigned role and groups.

Request:
emails                - List of email addresses to invite.
roleId               - Role to assign to all invited users.
groupIds             - List of group IDs to add all invited users to.
defaultSiteDomain   - The site domain context used for the invitation link.

Response:
userIds              - List of IDs of the newly created user accounts.