Users API

Accounts are managed under /api/db-devops/users, invitations under /api/onboarding, and passwords set from a link under /api/auth. Changes need the admin role. Errors are JSON with error and code.

Routes

/api/auth/register, GET /api/auth/users, PUT /api/auth/users/:id/role and DELETE /api/auth/users/:id (which deactivates) apply the same checks.

Accounts

{ "id": "…", "email": "dba@example.com", "name": "Dana", "role": "approver", "is_active": true,
  "last_login": "2026-10-08T14:02:11Z", "invite_pending": false, "created_at": "…", "updated_at": "…" }

invite_pending is true for an invited account that has not set its password yet. No route returns passwords, password hashes, MFA secrets, backup codes or reset tokens.

Creating and changing accounts

POST /api/db-devops/users
{ "email": "dba@example.com", "name": "Dana", "role": "approver", "password": "Strong-pass-2026!" }

PUT /api/db-devops/users/:id
{ "role": "release_manager" }

PUT /api/db-devops/users/:id/password
{ "new_password": "Another-pass-2026!", "current_password": "…" }

POST /api/onboarding/provision-user
{ "email": "dba@example.com", "name": "Dana", "role": "user", "notify": true }
→ 201 { "success": true, "user": { … }, "setupUrl": "https://…/setup?token=…", "emailed": true }

• role is admin, release_manager, approver or user (default user); anything else is refused, never replaced.
• email must be a valid address of up to 254 characters; name up to 255 characters.
• Passwords need at least 12 characters, with an uppercase and a lowercase letter, a digit and a symbol. current_password is required when you change your own password.
• Only name, email and role can be sent to PUT /users/:id.

Sessions

Every request checks the account behind the session token. A deactivated or deleted account, or a session issued before a password reset, gets 401:

{ "error": "Your session has ended because the account was deactivated. Sign in again.", "code": "SESSION_ENDED" }

A role change applies to the account's next request.

Error codes