user

The user domain has 6 actions. On the meta surface they are all reached through arcane_user; on the individual surface each one is its own tool; on the dynamic surface run them with arcane_execute_action and the canonical ID.

Summary

Action	Title	Kind
user.avatar	Get user avatar	read
user.create	Create a user	write
user.delete	Delete a user	destructive
user.get	Get a user	read
user.list	List users	read
user.update	Update a user	write

Actions

user.avatar

Get user avatar

Get the custom profile picture for a user

• Kind: read
• Required parameters: userId
• Meta tool: arcane_user with "action": "avatar"
• Individual tool: arcane_user_avatar
• Arcane route: GET /api/users/{userId}/avatar
• Operation ID: getUserAvatar
• Usage: Downloads a user’s custom profile picture by userId (from user.list). The route is public, and the result gives contentType and bytes with the image as an embedded resource. Returns 404 when the user has no custom avatar (avatarUrl is empty in user.get): fall back to app_image.get_default_profile. Users set or remove their own with auth.avatar_upload and auth.avatar_delete.
• Related actions: user.get, app_image.get_default_profile, auth.avatar_upload, auth.avatar_delete

user.create

Create a user

Create a new user account

• Kind: write
• Required parameters: password, username
• Meta tool: arcane_user with "action": "create"
• Individual tool: arcane_user_create
• Arcane route: POST /api/users
• Operation ID: createUser
• Usage: Creates a local account (needs users:create): username (no @, must be unique, 409 if taken) and password (at least 8 characters and checked against the authPasswordPolicy setting) are required, and displayName, email, locale and timeFormat (auto, 12h, 24h) are optional. The account starts without any role and can do almost nothing until a global admin assigns one with role.user_assignments_set (role IDs from role.list). The result’s id is the userId for that call.
• Related actions: role.list, role.user_assignments_set, user.get

user.delete

Delete a user

Delete a user by ID

• Kind: destructive — requires confirm: true
• Required parameters: userId
• Meta tool: arcane_user with "action": "delete"
• Individual tool: arcane_user_delete
• Arcane route: DELETE /api/users/{userId}
• Operation ID: deleteUser
• Usage: Permanently deletes the account by userId (from user.list, needs users:delete). Refused with 409 for the last global admin (canDelete=false in user.get) and with 403 when a caller who is not a global admin targets a global admin. The user’s cached tokens are invalidated.
• Related actions: user.list, user.get, role.user_assignments_set

user.get

Get a user

Get a user by ID

• Kind: read
• Required parameters: userId
• Meta tool: arcane_user with "action": "get"
• Individual tool: arcane_user_get
• Arcane route: GET /api/users/{userId}
• Operation ID: getUser
• Usage: One user by userId (from user.list), with roleAssignments (roleId, environmentId, source), the resolved permissionsByEnv map, isGlobalAdmin and canDelete (false for the only global admin). Needs users:read and returns 404 for an unknown ID. For yourself use auth.me, which needs only a login.
• Related actions: user.list, auth.me, role.user_assignments_get, user.update

user.list

List users

Get a paginated list of all users

• Kind: read
• Required parameters: none
• Meta tool: arcane_user with "action": "list"
• Individual tool: arcane_user_list
• Arcane route: GET /api/users
• Operation ID: listUsers
• Usage: Paginated Arcane user accounts (needs users:list, service accounts are excluded). Search matches username, email or display name, with start/limit/sort/order paging. Each item carries the id that user.get, user.update, user.delete and role.user_assignments_set take as userId, plus isGlobalAdmin, roleAssignments and canDelete. For the account behind this server’s own credential use auth.me.
• Related actions: user.get, user.create, auth.me, role.user_assignments_get

user.update

Update a user

Update an existing user’s information

• Kind: write
• Required parameters: userId
• Meta tool: arcane_user with "action": "update"
• Individual tool: arcane_user_update
• Arcane route: PUT /api/users/{userId}
• Operation ID: updateUser
• Usage: Admin edit of any user by userId (from user.list, needs users:update): only the fields you pass change among displayName, email, username, locale and timeFormat. An empty email is ignored rather than cleared. password resets it per authPasswordPolicy and clears requiresPasswordChange. Callers who are not global admins cannot set another user’s password or edit a global admin (403). Roles change through role.user_assignments_set, your own profile through auth.profile_update and your own password through auth.change_password.
• Related actions: user.get, role.user_assignments_set, auth.profile_update, auth.change_password