# User Management

APIs for User Management - Users, Roles, Permissions etc.

 - [GET /user-management/v2/groups](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/list.md): Optional filters: search (case-insensitive substring on group_name), source. Optional active=true|false — true returns only 'active' groups; false returns everything else (inactive/suspended/deprovisi
 - [POST /user-management/v2/groups](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/create.md): Creates a new user group with the details provided in the request.
 - [PUT /user-management/v2/groups](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/update.md): Updates the details of the specified user group.
 - [POST /user-management/v1/users](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/createuser.md): Creates a new User
 - [PUT /user-management/v1/users](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/updateuser.md): Updates a User
 - [GET /user-management/v1/users/{userId}/roles](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getuserroles.md): Returns the role assigned to a user
 - [PUT /user-management/v1/users/{userId}/roles](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/updateuserroles.md): Assigns or replaces the role for a user
 - [GET /user-management/v1/users/{userId}/domains/{domainId}/metadata](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getmetadata.md): Gets the domain metadata for a user
 - [PUT /user-management/v1/users/{userId}/domains/{domainId}/metadata](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/setmetadata.md): Replaces the domain metadata for a user
 - [GET /user-management/v1/roles/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getrolebyid.md): Returns a role by ID
 - [PUT /user-management/v1/roles/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/updaterole.md): Updates a role
 - [DELETE /user-management/v1/roles/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/deleterole.md): Deletes a role. 409 ROLE_IS_SYSTEM on baseline roles; 409 ROLE_IN_USE with impact-list details if any users or groups are still bound (unbind first). 204 on success.
 - [GET /user-management/v1/rbac-config](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getconfig.md): Returns the current per-tenant RBAC configuration (default role, SCIM JIT toggle, conflict policy). Served from the in-process cache; no DB round-trip on the happy path.
 - [PUT /user-management/v1/rbac-config](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/updateconfig.md): Partial update of the tenant RBAC config; refreshes the in-process cache on commit. At least one field must be provided.
 - [GET /user-management/v1/permissions/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getpermission.md): Returns a permission by ID
 - [GET /user-management/v1/domains](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/list_1.md): Lists all domains for a given tenant
 - [POST /user-management/v1/domains](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/create_1.md): Creates a new domain
 - [PUT /user-management/v1/domains](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/update_1.md): Updates an existing domain
 - [GET /user-management/scim/v2/Users/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getuser.md): Returns a SCIM user by ID
 - [PUT /user-management/scim/v2/Users/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/replaceuser.md): Replaces all attributes of a SCIM user
 - [DELETE /user-management/scim/v2/Users/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/deleteuser.md): Deprovisions a SCIM user
 - [PATCH /user-management/scim/v2/Users/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/patchuser.md): Partially updates a SCIM user
 - [POST /user-management/v2/groups/search](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/searchusergroups.md): Advanced Searches User groups with search criterion
 - [GET /user-management/v1/users/{userId}/domains](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getuserdomains.md): Lists all domain assignments for a user with their metadata
 - [POST /user-management/v1/users/{userId}/domains](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/assigndomain.md): Assigns a domain to a user with optional metadata
 - [POST /user-management/v1/users/search](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/searchusers.md): Advanced Searches Users with search criterion
 - [POST /user-management/v1/users/count](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/countusers.md): Returns the total number of users matching the same filter used by POST /v1/users/search. Pagination and sort fields in the request are ignored.
 - [GET /user-management/v1/roles](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getroles.md): Fetches a list of roles, optionally filtered by tenant ID.
 - [POST /user-management/v1/roles](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/createrole.md): Creates a new role
 - [GET /user-management/v1/roles/{id}/permissions](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getrolepermissions.md): Returns all permissions assigned to a role
 - [PATCH /user-management/v1/roles/{id}/permissions](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/patchpermissions.md): Atomic add + remove of permissions on a role in a single transaction. Returns the merged resource (full post-write permission set). 409 ROLE_IS_SYSTEM on baseline roles; 400 CONFLICTING_DELTA when add
 - [GET /user-management/v1/permissions](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/listpermissions.md): Returns a paginated list of permissions for a tenant
 - [GET /user-management/v1/api-keys](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/listapikeys.md): Lists all API keys for a tenant (metadata only, no hashes or plaintext).
 - [POST /user-management/v1/api-keys](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/createapikey.md): Creates a new API key for a tenant. Returns the plaintext key once.
 - [POST /user-management/v1/api-keys/validate](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/validateapikey.md): Validates an API key. Open endpoint — no authentication required. Called by pod-to-pod services.
 - [GET /user-management/scim/v2/Users](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/listusers.md): Returns a paginated list of SCIM users
 - [POST /user-management/scim/v2/Users](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/createuser_1.md): Provisions a new SCIM user
 - [GET /user-management/scim/v2/Groups](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/listgroups.md): Returns a paginated list of SCIM groups
 - [POST /user-management/scim/v2/Groups](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/creategroup.md): Provisions a new SCIM group
 - [GET /user-management/v1/roles/{id}/groups](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getmappedgroups.md): Returns the role plus the groups currently conferring it (via xf_group_role_rel).
 - [PATCH /user-management/v1/roles/{id}/groups](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/addmappedgroups.md): Batch-adds one or more groups to this role in a single transaction. Non-stealing: 200 on success, 409 GROUP_ALREADY_MAPPED with a list of conflicts if any input group is currently mapped to a differen
 - [GET /user-management/v1/api-keys/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getapikey.md): Returns a single API key's metadata.
 - [DELETE /user-management/v1/api-keys/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/revokeapikey.md): Revokes (soft deletes) an API key.
 - [PATCH /user-management/v1/api-keys/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/updateapikey.md): Updates API key metadata (name, scopes, expiry).
 - [GET /user-management/scim/v2/Groups/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getgroup.md): Returns a SCIM group by ID
 - [DELETE /user-management/scim/v2/Groups/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/deletegroup.md): Deprovisions a SCIM group
 - [PATCH /user-management/scim/v2/Groups/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/patchgroup.md): Partially updates a SCIM group and its members
 - [GET /user-management/v2/groups/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getbyid.md): Retrieves the details of a user group using its unique identifier.
 - [DELETE /user-management/v2/groups/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/delete.md): Marks the specified user group as inactive without permanently removing it from the system.
 - [GET /user-management/v1/users/{userId}/effective-permissions](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getusereffectivepermissions.md): Admin view of another user's resolved permission set (module:operation slugs).
 - [GET /user-management/v1/users/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getuserdetail.md): Reads a User given user Id
 - [GET /user-management/v1/users/me](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getcurrentuserdetail.md): Reads the loggedIn User details
 - [GET /user-management/v1/provisioning/group-role-mappings](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/listgroupmappings.md): Cross-role view of xf_group_role_rel, newest first. Optional case-insensitive source filter.
 - [GET /user-management/v1/permissions/catalog](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getcatalog.md): Returns the module-grouped catalog. Optional ?source= filter (case-insensitive). Omitted defaults to source='seed' — the baseline rows the platform ships with. Reserved value 'all' returns every row a
 - [GET /user-management/v1/domains/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/getbyid_1.md): Reads a domain by ID
 - [DELETE /user-management/v1/domains/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/delete_1.md): Deletes a domain and its user assignments
 - [GET /user-management/scim/v2/ServiceProviderConfig](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/serviceproviderconfig.md): Returns supported SCIM features and authentication schemes
 - [GET /user-management/scim/v2/Schemas](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/schemas.md): Returns SCIM schema definitions for User and Group
 - [GET /user-management/scim/v2/ResourceTypes](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/resourcetypes.md): Returns supported SCIM resource types (User, Group)
 - [DELETE /user-management/v1/users/{userId}/roles/{roleId}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/revokeuserrole.md): Revokes one direct role grant. 404 if not assigned; 409 USER_ROLE_MINIMUM_REQUIRED if it would leave the user with zero roles.
 - [DELETE /user-management/v1/users/{userId}/domains/{domainId}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/removedomain.md): Removes a domain assignment from a user
 - [DELETE /user-management/v1/roles/{id}/groups/{groupId}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/removemappedgroup.md): Deletes the xf_group_role_rel row where role_id = {id} AND group_id = {groupId} and cascades a set-difference reconcile over the group's members. Fails with 409 UNMAP_WOULD_STRIP_LAST_ROLE if any affe
 - [PUT /user-management/v1/permissions/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/updatepermission.md): Deprecated: permission catalog is seed-managed; runtime update is retained for backwards compatibility.
 - [DELETE /user-management/v1/permissions/{id}](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/deletepermission.md): Deprecated: permission catalog is seed-managed; runtime delete is retained for backwards compatibility.
 - [POST /user-management/v1/roles/{id}/permissions](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/assignpermissions.md): Deprecated: use PATCH /v1/roles/{id}/permissions — strict superset, atomic add+remove in one transaction.
 - [DELETE /user-management/v1/roles/{id}/permissions](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/unassignpermissions.md): Deprecated: use PATCH /v1/roles/{id}/permissions — strict superset, atomic add+remove in one transaction.
 - [POST /user-management/v1/permissions](https://docs.businessai.uniphorecloud.com/api-reference/api/user-management/createpermission.md): Deprecated: permission catalog is seed-managed; runtime create is retained for backwards compatibility.