User Authentication

POST /users/refresh

Refresh access token

Generate a new access token using a valid refresh token

Request JSON Object:

  • refresh_token (string) – (required)

Status Codes:
POST /users/register

Register new user

Create a new user account with email and password

Request JSON Object:

  • approvers (string)

  • created_at (string)

  • cs_account_id (string)

  • cs_domain_id (string)

  • cs_user_id (string) – ===== CLOUDSTACK JIT CONTEXT =====

  • email (string)

  • external_subject (string) – ExternalSubject is the stable opaque provider identity for SSO users. Format: “ldap:<DN>”, “oidc:<issuer>:<sub>”, “saml:<entityID>:<nameID>”. Empty for native local-auth users. Used as the primary JIT lookup key to prevent duplicate provisioning when the derived username changes between logins.

  • first_name (string)

  • id (integer)

  • is_2fa_required (boolean)

  • is_active (boolean)

  • last_jit_at (string)

  • last_name (string)

  • org_key (string)

  • password (string)

  • provisioning_state (string) – “provisioned” | “failed” | “”

  • registered (boolean)

  • requires_approval (boolean)

  • roles[].created_at (string)

  • roles[].default (boolean)

  • roles[].description (string)

  • roles[].id (integer)

  • roles[].name (string) – (required)

  • roles[].permissions[].created_at (string)

  • roles[].permissions[].id (integer)

  • roles[].permissions[].name (string)

  • roles[].role (string) – (required)

  • roles[].updated_at (string)

  • tenant_id (string) – ===== TENANT CONTEXT (Multi-Tenancy) =====

  • tenant_name (string)

  • totp_enabled (boolean)

  • ui_preferences (string) – UIPreferences holds per-user, per-feature UI state (e.g. onboarding/tour “seen” flags), namespaced by tab: {“kforge”:{“tour_seen”:true}, …}. One JSONB blob so new tabs/variables need no migration; updated via PATCH /users/me/ui-preferences (server-side deep-merge).

  • updated_at (string)

  • username (string)

Status Codes:
POST /users/reset-password

Reset password

Reset user password by providing the username, the OTP issued by an admin, and the new password. No authentication token is required — the OTP is the credential.

Request JSON Object:

  • new_password (string) – (required)

  • otp (string)

  • username (string) – (required)

Status Codes: