Profile API

Promo codes on a user return the grant name, not the redemption code.

Endpoints

Method	Path	What it does
GET	`/api/users`	List users the caller can see
GET	`/api/users/:userId`	Read a user
PUT	`/api/users/:userId`	Update a user
GET	`/api/users/:userId/configurations`	Read user configuration
PUT	`/api/users/:userId/configurations`	Update user configuration
GET	`/api/users/:userId/promocodes`	List user grants
POST	`/api/users/:userId/promocodes`	Redeem a user code

Read a user

GET /api/users/:userId returns the user.

Request

curl -X GET "https://api.requestrocket.com/api/users/:userId" \
  -H "Authorization: u-your-token"

import axios from "axios";

const response = await axios.request({
  method: "GET",
  url: "https://api.requestrocket.com/api/users/:userId",
  headers: {
    "Authorization": "u-your-token",
  }
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "GET",
    "https://api.requestrocket.com/api/users/:userId",
    headers={
        "Authorization": "u-your-token",
    }
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    var payload io.Reader
    req, _ := http.NewRequest("GET", "https://api.requestrocket.com/api/users/:userId", payload)
    req.Header.Set("Authorization", "u-your-token")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/:userId"))
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .header("Authorization", "u-your-token")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "users": [
    {
      "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
      "userFirstName": "Alex",
      "userLastName": "Example",
      "userUsername": "alex",
      "userBio": null,
      "userEmail": "alex@example.com",
      "userPhone": "",
      "userClients": [
        "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90"
      ],
      "userMsps": [],
      "userCreated": "2026-11-02T07:30:00.000Z",
      "userUpdated": "2026-11-02T07:30:00.000Z",
      "isSystemAdmin": false
    }
  ],
  "message": "Success"
}

{
  "message": "Unauthorized to list this users details"
}

{
  "Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}

{
  "message": "method / endpoint not supported"
}

Returns the authenticated user in users, plus message. GET /api/users returns the same object. There are no query parameters and the call is not paginated. A different user's id returns 401.

Response attributes

Attribute	Type	Description
`users`	array	One object, the authenticated user.
`users[].userId`	string	User id.
`users[].userFirstName`	string	First name.
`users[].userLastName`	string	Last name.
`users[].userUsername`	string	Username.
`users[].userBio`	string or null	Biography.
`users[].userEmail`	string	Email address.
`users[].userPhone`	string	Phone number. May be empty.
`users[].userClients`	array	Organisation ids the user belongs to.
`users[].userMsps`	array	Partner organisation ids, when the user belongs to any.
`users[].userCreated`	string	ISO 8601 creation time.
`users[].userUpdated`	string	ISO 8601 last update time.
`users[].isSystemAdmin`	boolean	True when the user has the system admin role.
`message`	string	`Success`.

Token ids and role names are left out of this object.

PUT /api/users/:userId updates the signed-in user's name, biography, and phone number. All fields are optional. Omit a field to leave it unchanged. A blank value is left unchanged. A userEmail value in the body is ignored.

Request

curl -X PUT "https://api.requestrocket.com/api/users/:userId" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "userFirstName": "Alex",
  "userLastName": "Example",
  "userBio": "Builds APIs.",
  "userPhone": "+61400000000"
}'

import axios from "axios";

const response = await axios.request({
  method: "PUT",
  url: "https://api.requestrocket.com/api/users/:userId",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "userFirstName": "Alex",
  "userLastName": "Example",
  "userBio": "Builds APIs.",
  "userPhone": "+61400000000"
}
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "PUT",
    "https://api.requestrocket.com/api/users/:userId",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"userFirstName\": \"Alex\",\n  \"userLastName\": \"Example\",\n  \"userBio\": \"Builds APIs.\",\n  \"userPhone\": \"+61400000000\"\n}"
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "userFirstName": "Alex",
  "userLastName": "Example",
  "userBio": "Builds APIs.",
  "userPhone": "+61400000000"
}`)
    req, _ := http.NewRequest("PUT", "https://api.requestrocket.com/api/users/:userId", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/:userId"))
            .method("PUT", HttpRequest.BodyPublishers.ofString("{\n  \"userFirstName\": \"Alex\",\n  \"userLastName\": \"Example\",\n  \"userBio\": \"Builds APIs.\",\n  \"userPhone\": \"+61400000000\"\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "users": [
    {
      "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
      "userFirstName": "Alex",
      "userLastName": "Example",
      "userUsername": "alex",
      "userBio": "Builds APIs.",
      "userEmail": "alex@example.com",
      "userPhone": "+61400000000",
      "userClients": [
        "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90"
      ],
      "userMsps": [],
      "userCreated": "2026-11-02T07:30:00.000Z",
      "userUpdated": "2026-11-02T08:00:00.000Z",
      "isSystemAdmin": false
    }
  ],
  "message": "Success"
}

{
  "message": "Unauthorized to edit this users details"
}

Request body

Parameter	Type	Description
`userFirstName`	string	First name.
`userLastName`	string	Last name.
`userBio`	string	Biography.
`userPhone`	string	Phone number.

Returns the updated user in users. The attributes match Read a user.

Read user configuration

GET /api/users/:userId/configurations returns the user's preferences. configurationType=user is required. When nothing has been saved, the response is the platform default.

Request

curl -X GET "https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user" \
  -H "Authorization: u-your-token"

import axios from "axios";

const response = await axios.request({
  method: "GET",
  url: "https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user",
  headers: {
    "Authorization": "u-your-token",
  }
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "GET",
    "https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user",
    headers={
        "Authorization": "u-your-token",
    }
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    var payload io.Reader
    req, _ := http.NewRequest("GET", "https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user", payload)
    req.Header.Set("Authorization", "u-your-token")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user"))
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .header("Authorization", "u-your-token")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "configuration": {
    "notifications": {
      "emailEnabled": false,
      "mobileEnabled": false
    },
    "promotionalCodes": null,
    "sharing": {},
    "achievements": {
      "createdProxyCredential": false,
      "createdTargetCredential": false,
      "createdProxy": false,
      "createdOrganisation": false,
      "invitedSomeone": false,
      "readNotifications": false,
      "viewedPerformance": false,
      "createdTokens": false,
      "usedTokens": false,
      "deletedToken": false,
      "createdTarget": false,
      "createdOverride": false,
      "createdRule": false,
      "createdFilter": false,
      "createdMeter": false,
      "createdAlert": false,
      "createdTransform": false,
      "createdMcp": false,
      "createdConsumer": false,
      "createdEntitlement": false,
      "createdMsp": false,
      "viewedRequests": false
    }
  },
  "message": "Success"
}

{
  "message": "configurationType query parameter is required"
}

Query parameters

Parameter	Type	Required	Description
`configurationType`	string	✓	Must be `user`.

Returns configuration and message. This call is not paginated.

Response attributes

Attribute	Type	Description
`configuration.notifications.emailEnabled`	boolean	Whether email notifications are enabled.
`configuration.notifications.mobileEnabled`	boolean	Whether mobile notifications are enabled.
`configuration.promotionalCodes`	array or null	Applied grants. Each item has `name`, `createdAt`, and `expiresAt`. The redemption code is absent.
`configuration.sharing`	object	Free-form sharing preferences.
`configuration.achievements`	object	System-managed booleans: `createdProxyCredential`, `createdTargetCredential`, `createdProxy`, `createdOrganisation`, `invitedSomeone`, `readNotifications`, `viewedPerformance`, `createdTokens`, `usedTokens`, `deletedToken`, `createdTarget`, `createdOverride`, `createdRule`, `createdFilter`, `createdMeter`, `createdAlert`, `createdTransform`, `createdMcp`, `createdConsumer`, `createdEntitlement`, `createdMsp`, `viewedRequests`.
`message`	string	`Success`.

Update user configuration

PUT /api/users/:userId/configurations updates notification and sharing preferences. All fields are optional. Omit a field to leave it unchanged. Sending notifications replaces that object, so include both booleans. Sending sharing replaces the stored sharing object. configurationType=user is required.

A promotionalCodes value in the body is discarded. Redeem codes with POST /api/users/:userId/promocodes. achievements stays as stored. If you send achievements, it must include every flag listed above or the call is rejected.

Request

curl -X PUT "https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "notifications": {
    "emailEnabled": true,
    "mobileEnabled": false
  }
}'

import axios from "axios";

const response = await axios.request({
  method: "PUT",
  url: "https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "notifications": {
    "emailEnabled": true,
    "mobileEnabled": false
  }
}
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "PUT",
    "https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"notifications\": {\n    \"emailEnabled\": true,\n    \"mobileEnabled\": false\n  }\n}"
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "notifications": {
    "emailEnabled": true,
    "mobileEnabled": false
  }
}`)
    req, _ := http.NewRequest("PUT", "https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/:userId/configurations?configurationType=user"))
            .method("PUT", HttpRequest.BodyPublishers.ofString("{\n  \"notifications\": {\n    \"emailEnabled\": true,\n    \"mobileEnabled\": false\n  }\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "configuration": {
    "notifications": {
      "emailEnabled": true,
      "mobileEnabled": false
    },
    "promotionalCodes": null,
    "sharing": {},
    "achievements": {
      "createdProxyCredential": false,
      "createdTargetCredential": false,
      "createdProxy": false,
      "createdOrganisation": false,
      "invitedSomeone": false,
      "readNotifications": false,
      "viewedPerformance": false,
      "createdTokens": false,
      "usedTokens": false,
      "deletedToken": false,
      "createdTarget": false,
      "createdOverride": false,
      "createdRule": false,
      "createdFilter": false,
      "createdMeter": false,
      "createdAlert": false,
      "createdTransform": false,
      "createdMcp": false,
      "createdConsumer": false,
      "createdEntitlement": false,
      "createdMsp": false,
      "viewedRequests": false
    }
  },
  "message": "Configuration updated successfully"
}

{
  "message": "Input failed data validation",
  "errors": [
    "/notifications: must have required property 'emailEnabled'"
  ]
}

Query parameters

Parameter	Type	Required	Description
`configurationType`	string	✓	Must be `user`.

Request body

Parameter	Type	Description
`notifications`	object	Email and mobile preferences. When present, both booleans below are required.
`notifications.emailEnabled`	boolean	Send email notifications when true.
`notifications.mobileEnabled`	boolean	Send mobile notifications when true.
`sharing`	object	Free-form sharing preferences. Replaces the stored object.

Returns the saved configuration. Attributes match Read user configuration. message is Configuration updated successfully.

List user grants

GET /api/users/:userId/promocodes lists the public names of grants on the user. The redemption code is absent.

Request

curl -X GET "https://api.requestrocket.com/api/users/:userId/promocodes" \
  -H "Authorization: u-your-token"

import axios from "axios";

const response = await axios.request({
  method: "GET",
  url: "https://api.requestrocket.com/api/users/:userId/promocodes",
  headers: {
    "Authorization": "u-your-token",
  }
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "GET",
    "https://api.requestrocket.com/api/users/:userId/promocodes",
    headers={
        "Authorization": "u-your-token",
    }
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    var payload io.Reader
    req, _ := http.NewRequest("GET", "https://api.requestrocket.com/api/users/:userId/promocodes", payload)
    req.Header.Set("Authorization", "u-your-token")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/:userId/promocodes"))
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .header("Authorization", "u-your-token")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "promotionalCodes": [
    {
      "name": "Example grant",
      "createdAt": "2026-11-02T07:30:00.000Z",
      "expiresAt": "2027-02-02T07:30:00.000Z"
    }
  ],
  "message": "Success"
}

Returns the applied grants. This list is not paginated and takes no query parameters.

Response attributes

Attribute	Type	Description
`promotionalCodes`	array or null	Grants on the user.
`promotionalCodes[].name`	string	Public name of the grant.
`promotionalCodes[].createdAt`	string	ISO 8601 time of the first redemption.
`promotionalCodes[].expiresAt`	string	Recorded end time. Expiry is not enforced.
`message`	string	`Success`.

Redeem a user code

POST /api/users/:userId/promocodes redeems a secret code onto the user. The code is checked and not stored. Redeeming a grant that is already present leaves createdAt and expiresAt as they were.

Request

curl -X POST "https://api.requestrocket.com/api/users/:userId/promocodes" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "code": "YOUR-CODE"
}'

import axios from "axios";

const response = await axios.request({
  method: "POST",
  url: "https://api.requestrocket.com/api/users/:userId/promocodes",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "code": "YOUR-CODE"
}
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "POST",
    "https://api.requestrocket.com/api/users/:userId/promocodes",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"code\": \"YOUR-CODE\"\n}"
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "code": "YOUR-CODE"
}`)
    req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/users/:userId/promocodes", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/:userId/promocodes"))
            .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"code\": \"YOUR-CODE\"\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "promotionalCodes": [
    {
      "name": "Example grant",
      "createdAt": "2026-11-02T07:30:00.000Z",
      "expiresAt": "2027-02-02T07:30:00.000Z"
    }
  ],
  "applied": {
    "name": "Example grant",
    "createdAt": "2026-11-02T07:30:00.000Z",
    "expiresAt": "2027-02-02T07:30:00.000Z"
  },
  "alreadyApplied": false,
  "message": "Promotional code applied"
}

{
  "message": "code must not be empty"
}

Request body

Parameter	Type	Required	Description
`code`	string	✓	Secret redemption code.

Returns the grants after this call, the grant this code maps to, and whether it was already present.

Response attributes

Attribute	Type	Description
`promotionalCodes`	array	Grants on the user after this call. Items match List user grants.
`applied.name`	string	Public name of the grant.
`applied.createdAt`	string	ISO 8601 time of the first redemption.
`applied.expiresAt`	string	Recorded end time. Expiry is not enforced.
`alreadyApplied`	boolean	True when this grant was already on the user. The dates stay as they were.
`message`	string	`Promotional code applied`, or `Promotional code already applied`.

Shared status codes, the 5.5 MB cap, and plan rate limits are on Platform limits.

App guide

Do this in the app

API keys

Keys for the Core API and Core MCP

Notifications

Personal notification preferences

Sign in

How to sign in to the platform

On this page

Endpoints

Read a user

Request

Responses

Response attributes

Update a user

Request

Responses

Request body

Read user configuration

Request

Responses

Query parameters

Response attributes

Update user configuration

Request

Responses

Query parameters

Request body

List user grants

Request

Responses

Response attributes

Redeem a user code

Request

Responses

Request body

Response attributes

Next

App guide

API keys

Notifications

Sign in

On this page