Users API

List Project Users

GET /admin/projects/:projectId/users
Authorization: Bearer <admin_token>

Query Parameters

Parameter	Type	Default	Description
limit	number	20	Results per page (max 100)
offset	number	0	Pagination offset

Response

{
  "users": [
    {
      "user_id": "usr_abc123",
      "email": "user@example.com",
      "role": "member",
      "status": "active",
      "joined_at": "2025-03-10T14:30:00Z"
    },
    {
      "user_id": "usr_def456",
      "email": "admin@example.com",
      "role": "admin",
      "status": "active",
      "joined_at": "2025-01-15T10:00:00Z"
    }
  ],
  "total": 2
}

Update User

Change a user’s role or status within a project.

PATCH /admin/projects/:projectId/users/:userId
Authorization: Bearer <admin_token>
Content-Type: application/json

Request Body

Field	Type	Description
role	string	"admin" or "member"
status	string	"active" or "blocked"

Examples

Block a user:

curl -X PATCH https://auth.beshoy.ai/admin/projects/proj_gym/users/usr_abc123 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "status": "blocked" }'

Promote to admin:

curl -X PATCH https://auth.beshoy.ai/admin/projects/proj_gym/users/usr_abc123 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "role": "admin" }'

Response

{ "ok": true }

Remove User

Remove a user from a project entirely. This also revokes all their active sessions.

DELETE /admin/projects/:projectId/users/:userId
Authorization: Bearer <admin_token>

Example

curl -X DELETE https://auth.beshoy.ai/admin/projects/proj_gym/users/usr_abc123 \
  -H "Authorization: Bearer $TOKEN"

Response

{ "ok": true }

Blocking vs. Removing

Action	Effect	Reversible
Block	User can’t refresh tokens; existing access tokens expire in 5 min	Yes (set status back to “active”)
Remove	User removed from project; all sessions revoked; must be re-invited	Yes (re-add via invite)

Blocking is preferred for temporary suspensions. Removal is for permanent access revocation.