Users
For instructions on how to authenticate to use this endpoint, see API overview.
Endpoints
POST | |
DELETE | |
GET | |
POST | |
GET | |
DELETE | |
POST | |
POST | |
PATCH | |
POST |
Create users integrations github start
Start GitHub linking: either full App install or OAuth-only (user-to-server).
**_kwargs absorbs parent_lookup_uuid from the nested
/api/users/{uuid}/integrations/ router (same pattern as local_evaluation
under projects).
Usually returns install_url pointing at /installations/new so the
user can pick any GitHub org (new or already connected). GitHub's install
page handles both cases: orgs where the app is installed show "Configure"
(no admin needed), orgs where it isn't show "Install" (needs admin).
OAuth fast path: when the current project already has a team-level
GitHub installation, and the user has no UserIntegration for that
installation yet, we skip the org picker and redirect straight to
/login/oauth/authorize so the user only authorizes themselves.
connect_from is preserved for first-party clients so they return to
the originating client immediately.
In both cases the response key is install_url for compatibility with callers.
Required API key scopes
user:writePath parameters
- uuidstring
Request parameters
- team_idintegernull
- connect_fromstring
Response
Example request
POST /api /users /:uuid /integrations /github /startExample response
Status 200
Create users integrations github start
Start GitHub linking: either full App install or OAuth-only (user-to-server).
**_kwargs absorbs parent_lookup_uuid from the nested
/api/users/{uuid}/integrations/ router (same pattern as local_evaluation
under projects).
Usually returns install_url pointing at /installations/new so the
user can pick any GitHub org (new or already connected). GitHub's install
page handles both cases: orgs where the app is installed show "Configure"
(no admin needed), orgs where it isn't show "Install" (needs admin).
OAuth fast path: when the current project already has a team-level
GitHub installation, and the user has no UserIntegration for that
installation yet, we skip the org picker and redirect straight to
/login/oauth/authorize so the user only authorizes themselves.
connect_from is preserved for first-party clients so they return to
the originating client immediately.
In both cases the response key is install_url for compatibility with callers.
Required API key scopes
user:writePath parameters
- uuidstring
Request parameters
- team_idintegernull
- connect_fromstring
Response
Example request
POST /api /users /:uuid /integrations /github /startExample response
Status 200
Delete users integrations slack
Remove a Slack identity link by Slack user id. Idempotent and flag-agnostic — users must always be able to unlink even after the feature flag is turned off.
Required API key scopes
user:writePath parameters
- slack_user_idstring
- uuidstring
Example request
DELETE /api /users /:uuid /integrations /slack /:slack_user_idExample response
Status 204 Slack link removed.
Delete users integrations slack
Remove a Slack identity link by Slack user id. Idempotent and flag-agnostic — users must always be able to unlink even after the feature flag is turned off.
Required API key scopes
user:writePath parameters
- slack_user_idstring
- uuidstring
Example request
DELETE /api /users /:uuid /integrations /slack /:slack_user_idExample response
Status 204 Slack link removed.
Retrieve users integrations slack linkable workspaces
Return Slack workspaces in the user's organizations that they have not yet linked. The settings UI uses this list to decide whether to show a "Link my Slack account" button (non-empty list) and what to offer in the picker when several are connectable.
Required API key scopes
user:readPath parameters
- uuidstring
Response
Example request
GET /api /users /:uuid /integrations /slack /linkable_workspacesExample response
Status 200
Retrieve users integrations slack linkable workspaces
Return Slack workspaces in the user's organizations that they have not yet linked. The settings UI uses this list to decide whether to show a "Link my Slack account" button (non-empty list) and what to offer in the picker when several are connectable.
Required API key scopes
user:readPath parameters
- uuidstring
Response
Example request
GET /api /users /:uuid /integrations /slack /linkable_workspacesExample response
Status 200
Create users integrations slack start
Mint a Sign-in-with-Slack invite URL initiated from settings, without
Slack-DM context. The returned URL takes the user through PostHog login
(already satisfied here), then to Slack OAuth, then back to our callback
which writes the UserIntegration row.
Without body params, falls back to the user's current_team and that
team's first Slack Integration — works when there's exactly one
linkable workspace. With team_id + slack_team_id, links against
the exact pair (what the frontend uses when a picker is shown).
Refuses if the target team has no matching Slack workspace, if the feature flag is off for the workspace, or if the user is already linked to it.
Required API key scopes
user:writePath parameters
- uuidstring
Request parameters
- team_idintegernull
- slack_team_idstringnull
Response
Example request
POST /api /users /:uuid /integrations /slack /startExample response
Status 200
Create users integrations slack start
Mint a Sign-in-with-Slack invite URL initiated from settings, without
Slack-DM context. The returned URL takes the user through PostHog login
(already satisfied here), then to Slack OAuth, then back to our callback
which writes the UserIntegration row.
Without body params, falls back to the user's current_team and that
team's first Slack Integration — works when there's exactly one
linkable workspace. With team_id + slack_team_id, links against
the exact pair (what the frontend uses when a picker is shown).
Refuses if the target team has no matching Slack workspace, if the feature flag is off for the workspace, or if the user is already linked to it.
Required API key scopes
user:writePath parameters
- uuidstring
Request parameters
- team_idintegernull
- slack_team_idstringnull
Response
Example request
POST /api /users /:uuid /integrations /slack /startExample response
Status 200
List all users login sessions
List the cookie-auth login sessions for the current user. Self-only — never another user.
Path parameters
- uuidstring
Query parameters
- emailstring
- is_staffboolean
Example request
GET /api /users /:uuid /login_sessionsExample response
Status 200
List all users login sessions
List the cookie-auth login sessions for the current user. Self-only — never another user.
Path parameters
- uuidstring
Query parameters
- emailstring
- is_staffboolean
Example request
GET /api /users /:uuid /login_sessionsExample response
Status 200
Delete users login sessions
Revoke a single login session belonging to the current user. Self-only.
Requires recent auth (TimeSensitiveActionPermission) so a stolen cookie can't weaponize revocation, and is blocked while impersonating via ImpersonationBlockedPathsMiddleware.
Path parameters
- session_idstring
- uuidstring
Example request
DELETE /api /users /:uuid /login_sessions /:session_idExample response
Status 204 Login session revoked.
Delete users login sessions
Revoke a single login session belonging to the current user. Self-only.
Requires recent auth (TimeSensitiveActionPermission) so a stolen cookie can't weaponize revocation, and is blocked while impersonating via ImpersonationBlockedPathsMiddleware.
Path parameters
- session_idstring
- uuidstring
Example request
DELETE /api /users /:uuid /login_sessions /:session_idExample response
Status 204 Login session revoked.
Create users login sessions revoke others
Revoke every login session for the current user except the one making this request. Self-only.
Requires recent auth (TimeSensitiveActionPermission) so a stolen cookie can't weaponize the "log out everywhere else" lock-out, and is blocked while impersonating.
Path parameters
- uuidstring
Response
Example request
POST /api /users /:uuid /login_sessions /revoke_othersExample response
Status 200
Create users login sessions revoke others
Revoke every login session for the current user except the one making this request. Self-only.
Requires recent auth (TimeSensitiveActionPermission) so a stolen cookie can't weaponize the "log out everywhere else" lock-out, and is blocked while impersonating.
Path parameters
- uuidstring
Response
Example request
POST /api /users /:uuid /login_sessions /revoke_othersExample response
Status 200
Create users onboarding skip
Mark the current user as having exited onboarding with a non-delegated reason. Idempotent: the skip timestamp is only set on the first successful call.
Callers wanting to delegate setup to a teammate must use the dedicated /organizations/{id}/invites/delegate/ endpoint, which atomically creates the invite and sets reason="delegated". This endpoint rejects that reason so state can't be faked without a real invite.
Path parameters
- uuidstring
Request parameters
- reason
- step_at_skipstring
Response
Example request
POST /api /users /:uuid /onboarding /skipExample response
Status 200
Create users onboarding skip
Mark the current user as having exited onboarding with a non-delegated reason. Idempotent: the skip timestamp is only set on the first successful call.
Callers wanting to delegate setup to a teammate must use the dedicated /organizations/{id}/invites/delegate/ endpoint, which atomically creates the invite and sets reason="delegated". This endpoint rejects that reason so state can't be faked without a real invite.
Path parameters
- uuidstring
Request parameters
- reason
- step_at_skipstring
Response
Example request
POST /api /users /:uuid /onboarding /skipExample response
Status 200
Update users product intro seen
Record that this user has seen one product intro.
Separate from the has_seen_product_intro_for field on the main user PATCH, which requires a
recently authenticated session. Dismissing an intro must not depend on that: a re-auth prompt
would cover the intro it interrupts, and the dismissal would never persist. Nothing reachable
here changes an account, an organization, or a profile.
Merging server-side also keeps two intros dismissed from separate tabs from dropping each other's key, which a read-modify-write of the whole map cannot avoid.
Required API key scopes
user:writePath parameters
- uuidstring
Request parameters
- product_keystring
- seenbooleanDefault:
true
Example request
PATCH /api /users /:uuid /product_intro_seenExample response
Status 200 The user's whole `has_seen_product_intro_for` map, after the merge.
Update users product intro seen
Record that this user has seen one product intro.
Separate from the has_seen_product_intro_for field on the main user PATCH, which requires a
recently authenticated session. Dismissing an intro must not depend on that: a re-auth prompt
would cover the intro it interrupts, and the dismissal would never persist. Nothing reachable
here changes an account, an organization, or a profile.
Merging server-side also keeps two intros dismissed from separate tabs from dropping each other's key, which a read-modify-write of the whole map cannot avoid.
Required API key scopes
user:writePath parameters
- uuidstring
Request parameters
- product_keystring
- seenbooleanDefault:
true
Example request
PATCH /api /users /:uuid /product_intro_seenExample response
Status 200 The user's whole `has_seen_product_intro_for` map, after the merge.
Create users push tokens
Idempotent upsert: if the (user, token) pair already exists, platform and last_seen_at are refreshed. Otherwise a new row is created.
Required API key scopes
user:writePath parameters
- uuidstring
Request parameters
- tokenstring
- platform
Response
Example request
POST /api /users /:uuid /push_tokensExample response
Status 200 Token was registered or refreshed.
Create users push tokens
Idempotent upsert: if the (user, token) pair already exists, platform and last_seen_at are refreshed. Otherwise a new row is created.
Required API key scopes
user:writePath parameters
- uuidstring
Request parameters
- tokenstring
- platform
Response
Example request
POST /api /users /:uuid /push_tokens