Users — MDDB API

User management (admin only)

Register new user #

POST /v1/auth/register

Create a new user account. Requires admin authentication.

Authorization: BearerAuth

Request body #

Required.

Content type application/json: RegisterRequest

{
  "password": "securepassword123",
  "tenant": "acme",
  "username": "alice"
}

Responses #

Status	Description	Body
200	User registered successfully	RegisterResponse (application/json)
400	Invalid request	ErrorResponse (application/json)
403	Admin access required	ErrorResponse (application/json)
409	User already exists	ErrorResponse (application/json)

Get user permissions #

GET /v1/auth/permissions

Get all permissions for a specific user. Requires admin authentication.

Authorization: BearerAuth

Parameters #

Name	In	Type	Description
username (required)	query	string	Username to get permissions for

Responses #

Status	Description	Body
200	User permissions	array of Permission (application/json)
400	Username parameter required	ErrorResponse (application/json)
403	Admin access required	ErrorResponse (application/json)

Set user permissions #

POST /v1/auth/permissions

Set permissions for a user on a specific collection. Requires admin authentication.

Authorization: BearerAuth

Request body #

Required.

Content type application/json: SetPermissionRequest

{
  "admin": false,
  "collection": "blog",
  "read": true,
  "username": "alice",
  "write": true
}

Responses #

Status	Description	Body
200	Permission set successfully	SetPermissionResponse (application/json)
400	Invalid request	ErrorResponse (application/json)
403	Admin access required	ErrorResponse (application/json)

List all users #

GET /v1/auth/users

List all user accounts with their details. Requires admin authentication.

Authorization: BearerAuth

Responses #

Status	Description	Body
200	List of users	UsersListResponse (application/json)
403	Admin access required	ErrorResponse (application/json)

Delete user #

DELETE /v1/auth/users/{username}

Permanently deletes a user account and everything that grants it access: the record, its API keys, its per-collection permissions and its group memberships. The username becomes available again.

Changed in 2.13.0. This used to disable the account and keep it, which held the name against every later registration while answering {"status":"deleted"}. A client that read the disabled record back after deleting will no longer find it.

The audit log is unaffected — that is where the record of who existed and who removed them lives.

Requires admin authentication.

Authorization: BearerAuth

Parameters #

Name	In	Type	Description
username (required)	path	string	Username to delete

Responses #

Status	Description	Body
200	User deleted	object (application/json)
400	Username required	ErrorResponse (application/json)
403	Admin access required	ErrorResponse (application/json)
404	User not found	ErrorResponse (application/json)