Manage users

On this page

A Golden user is a human identity. It has profile information, one or more built-in roles, an enabled state, and an authentication type. Integrations use access tokens instead.

Administration of other users requires ADMIN. The self-service profile and password operations below are available to the signed-in user.

User properties

Property	Meaning
`id`	Golden user identifier
`email`	Unique sign-in address
`name`, `surname`	Display name
`roles`	Set containing `VIEWER`, `STEWARD`, and/or `ADMIN`
`internal`	Whether Golden manages the user’s password
`enabled`	Whether the account can be used
`locked`	Whether failed sign-in attempts have locked the account
`lastAccess`	Most recent recorded access time, when available
`language`, `timeZone`	Profile locale and time zone; creation defaults are `en` and `Europe/Madrid`
`attributes`	Additional profile attributes accepted by the user operation
`totalFailedAccesses`	Reported failed sign-in count; use the unlock operation to clear a lock

An internal user signs in with a Golden-managed password. A non-internal user signs in through an enabled identity-provider flow. User provisioning and provider availability are administrative choices for each deployment.

Create a user

curl -sS -X POST "$GOLDEN_URL/api/security/users" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "email": "jane.smith@example.com",
        "name": "Jane",
        "surname": "Smith",
        "roles": ["STEWARD"],
        "internal": true
      }'

Assign the narrowest role set that fits the person’s work, then grant the required entity or row access. A role alone does not grant access to business data. Follow the account onboarding flow provided by the service; the creation request does not supply a password.

Update a user

PUT /api/security/users/{id} replaces the user definition. Read the current user first and preserve the values you are not changing. Supply email, name, surname, roles, enabled, and internal, together with any profile attributes you need to retain; do not send only the changed field. Read the user again to verify the result. Use the dedicated lock and password operations rather than attempting to change reported account state through this body.

List and inspect users

curl -sS "$GOLDEN_URL/api/security/users" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN"

curl -sS "$GOLDEN_URL/api/security/users/id/$USER_ID" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN"

The signed-in user can retrieve their own profile from GET /api/security/users/my and update it through PUT /api/security/users/my. In the web application, users can open Profile to edit their own details and change their own password.

Enable, disable, or unlock

curl -sS -X PUT "$GOLDEN_URL/api/security/users/$USER_ID/disable" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN"

curl -sS -X PUT "$GOLDEN_URL/api/security/users/$USER_ID/enable" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN"

curl -sS -X PUT "$GOLDEN_URL/api/security/users/$USER_ID/unlock" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN"

Disable an account when access should stop but its identity record should be retained. Unlock is a separate operation; enabling a user is not a substitute for clearing a lock.

Initiate a password reset

For an internal user, an administrator can trigger the configured reset flow:

curl -sS -X DELETE "$GOLDEN_URL/api/security/users/password/$USER_ID" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN"

This operation initiates password recovery. It does not accept or directly set a replacement password. A delivery-provider failure can return 502; verify whether a reset message was delivered before retrying. Users can also start self-service recovery from PUT /api/security/password/reset/{email}.

An administrator can instead set an internal user’s password directly, including when no notification provider is configured:

curl --fail-with-body --silent --show-error \
  -X PUT "$GOLDEN_URL/api/security/users/password/$USER_ID" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN" \
  -H "Content-Type: text/plain" \
  --data-binary "$NEW_PASSWORD"

Use an approved secret-delivery channel and the deployment’s password policy. Have the user verify sign-in; do not include the password in logs or support requests.

Delete a user

curl -sS -X DELETE "$GOLDEN_URL/api/security/users/$USER_ID" \
  -H "Authorization: Bearer $GOLDEN_ADMIN_TOKEN"

Deletion is permanent. Prefer disabling an account unless your approved user lifecycle requires removal. Review access tokens separately because they are independent integration identities.