Accounts — Users — API Reference

List users#

GET /cdna-api/users/users

Lists users. Without limit every match comes back. The example selects no names, because the hub’s users are colleagues.

Access: Admin users and integrations, with an OAuth access token or an API key.
Model: User, in the Reference

Parameters

propertiesquery: selector; The fields and relations to return, such as {id,type,active}.
filtersquery: name=value; Any stored field, or a relation with a dot, such as parent.id=12. Prefix the name with !, >, <, % or |. Use stored field names exactly as in the model, and compare totalCount with the unfiltered list's to confirm a filter applied.
orderByquery: string; field:ASC or field:DESC, comma-separated. Stored fields only.
limitquery: integer; Records per response. There is no default.
offsetquery: integer; Records to skip.

Example

List users

GET /cdna-api/users/users?limit=2&properties={id,type,active} HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json

Response 200 OK

{
  "result": "success",
  "totalCount": 24,
  "data": [
    {
      "id": 27,
      "type": "frontend",
      "active": true
    },
    {
      "id": 8,
      "type": "admin",
      "active": true
    }
  ]
}

Real response from this documentation site

Show a user#

GET /cdna-api/users/user/{id}

Reads one user by its id.

Access: Admin users and integrations, with an OAuth access token or an API key.
Model: User, in the Reference

Parameters

idpathrequired: integer; The user id.
propertiesquery: selector; The fields and relations to return, such as {id,username,fullName,type}.

Example

Show a user

GET /cdna-api/users/user/63?properties={id,username,fullName,type} HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json

Response 200 OK

{
  "result": "success",
  "data": {
    "id": 63,
    "username": "person@example.com",
    "fullName": "API docs bot",
    "type": "developer"
  }
}

Real response from this documentation site

Create a user#

POST /cdna-api/users/user

Creates a user.

Access: Admin users and integrations, with an OAuth access token or an API key.
Returns: The new user under data.user, and a message.

Parameters

usernamebody: string; The sign-in name, often the email address. Required.
emailbody: string; The email address.
firstNamebody: string; The first name.
lastNamebody: string; The last name.

Example

Create a user

POST /cdna-api/users/user HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json
Content-Type: application/json

{
  "username": "person@example.com",
  "email": "person@example.com",
  "firstName": "Alex",
  "lastName": "Example"
}

Edit a user#

PUT /cdna-api/users/user/{id}

Changes a user. Fields left out keep their values.

Access: Admin users and integrations, with an OAuth access token or an API key.
Returns: The saved user under data.user, and a message.

Parameters

idpathrequired: integer; The user id.
lastNamebody: string; The last name.

Example

Edit a user

PUT /cdna-api/users/user/50 HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json
Content-Type: application/json

{
  "lastName": "Example-Smith"
}

Delete a user#

DELETE /cdna-api/users/user/{id}

Deletes a user.

Access: Admin users and integrations, with an OAuth access token or an API key.

Parameters

idpathrequired: integer; The user id.

Example

Delete a user

DELETE /cdna-api/users/user/50 HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json

Show your own account#

GET /cdna-api/users/account

Reads the signed-in user’s own account. A member may call it as well as an admin user.

Access: A signed-in member, for their own records, and admin users.
Model: User, in the Reference

Parameters

propertiesquery: selector; The fields and relations to return, such as {user{id,username,fullName}}.

Example

Show your own account

GET /cdna-api/users/account?properties={user{id,username,fullName}} HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json

Response 200 OK

{
  "result": "success",
  "data": {
    "user": {
      "id": 63,
      "username": "person@example.com",
      "fullName": "API docs bot"
    }
  }
}

Open in Postman docs Real response from this documentation site

Edit your own account#

PUT /cdna-api/users/account

Changes the signed-in user’s own account. Unlike reading it, this route refuses members with 403, so a member area changes the account another way.

Access: Admin users and integrations, with an OAuth access token or an API key.
Returns: The saved account under data.user, and a message.

Parameters

firstNamebody: string; The first name.
lastNamebody: string; The last name.
emailbody: string; The email address.

Example

Edit your own account

PUT /cdna-api/users/account HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json
Content-Type: application/json

{
  "firstName": "Alex",
  "lastName": "Example",
  "email": "person@example.com"
}

Open in Postman docs

Send a password reset email#

POST /cdna-api/forgot-password

Emails a password reset link. It answers success whether or not the address belongs to an account, so the route cannot be used to find out who has one.

Access: Anyone. The route takes no credentials, by design.

Parameters

emailbodyrequired: string; The address the account signs in with.
resetUrlbody: string; Your own reset page; the link in the email signs the person in there with a one-time token.

Example

Send a password reset email

POST /cdna-api/forgot-password HTTP/1.1
Host: hub.coredna.com
Accept: application/json
Content-Type: application/json

{
  "email": "person@example.com",
  "resetUrl": "https://your-domain.com/custom-reset-password-url"
}

Response 200 OK

{
  "result": "success",
  "data": [],
  "message": "If a user account with the specified email address exists, a password reset link has been sent to it."
}

Open in Postman docs Saved response from the Postman collection

Register#

POST /cdna-api/register

Creates a member account, when registration is on in the site’s settings; when it is off the route is a 404. The account’s type, status and groups come from those settings. It does not sign the person in: send them through the OAuth authorization flow next.

Access: Anyone. The route takes no credentials, by design.
Returns: HTTP 201 with the new account under data.user and the message “Successfully Registered”. A failed reCAPTCHA is “Recaptcha validation failed”.

Parameters

emailbodyrequired: string; The email address, which is also the sign-in name unless username is sent.
passwordbodyrequired: string; The password. Send confirmPassword with it: the length and match rules run only when it is there.
confirmPasswordbodyrequired: string; The password again.
firstName, lastNamebody: string; The person’s name.
g-recaptcha-responsebody: string; The reCAPTCHA answer, when the site’s registration uses one.

Example

Register

POST /cdna-api/register HTTP/1.1
Host: hub.coredna.com
Accept: application/json
Content-Type: application/json

{
  "email": "alex@example.com",
  "password": "a-long-passphrase",
  "confirmPassword": "a-long-passphrase",
  "firstName": "Alex",
  "lastName": "Example"
}

Learn more

GuideRegistration, sign-in and passwords ReferenceAuthentication

Set a new password#

POST /cdna-api/reset-password

The second step of a password reset: sets the password with the token from the reset email, which Send a password reset email sends. The token works once. An unknown, used or expired token, or an inactive account, is a 404.

Access: Anyone. The route takes no credentials, by design.
Returns: The message “The password has been successfully changed”.

Parameters

tokenbodyrequired: string; The token from the reset link.
passwordbodyrequired: string; The new password.

Example

Set a new password

POST /cdna-api/reset-password HTTP/1.1
Host: hub.coredna.com
Accept: application/json
Content-Type: application/json

{
  "token": "THE-TOKEN-FROM-THE-EMAIL",
  "password": "a-new-passphrase"
}

Response 404 Not FoundUnknown token

{
  "result": "error",
  "message": "Page or record not found"
}

Real response from this documentation site

POST

Makes a sign-in link for a user: whoever holds the token is signed in as that user, up to maxUses times and until it expires. Admin users only; it is what password reset emails are built on.

Access: Admin users and integrations, with an OAuth access token or an API key.
Returns: The new token under data.loginToken, with the generated token.
Model: LoginToken, in the Reference

Parameters

userbodyrequired: integer; The user it signs in as.
maxUsesbody: integer; How many times it works.
expiresbody: datetime; When it stops working.
expireTimeAfterUsebody: integer; How long it keeps working after its first use.
redirectUrlbody: string; Where the person lands after signing in.

A login token is as good as the user’s password. Send it only to that person, give it one use and a short life, and never log it.

Example

Create a login token

POST /cdna-api/users/login-token HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json
Content-Type: application/json

{
  "user": 50,
  "maxUses": 1,
  "expires": "2026-10-19T00:00:00+11:00",
  "redirectUrl": "/my-account"
}

Revoke an app’s access#

POST /cdna-api/users/user/{userId}/revokeAppAccess/{appId}

Withdraws a user’s approval of an OAuth app and revokes the tokens it holds for them. There is no body.

Access: Admin users and integrations, with an OAuth access token or an API key.
Returns: {"result":"success"}.

Parameters

userIdpathrequired: integer; The user id.
appIdpathrequired: integer; The OAuth client’s id.

Example

Revoke an app’s access

POST /cdna-api/users/user/50/revokeAppAccess/3 HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json

Learn more

ReferenceAuthentication

Revoke access tokens#

DELETE /cdna-api/users/user/{userId}/revokeAccessToken/{tokenId}

Revokes one of a user’s OAuth access tokens, or every one when the path ends at revokeAccessToken: the way to sign a user out of every app at once.

Access: Admin users and integrations, with an OAuth access token or an API key.
Returns: {"result":"success"}.

Parameters

userIdpathrequired: integer; The user id.
tokenIdpath: integer; The token’s id; left out, all of them.

Example

Revoke access tokens

DELETE /cdna-api/users/user/50/revokeAccessToken/812 HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json

Learn more

ReferenceAuthentication

List users#

Parameters

Example

Show a user#

Parameters

Example

Create a user#

Parameters

Example

Edit a user#

Parameters

Example

Delete a user#

Parameters

Example

Show your own account#

Parameters

Example

Edit your own account#

Parameters

Example

Send a password reset email#

Parameters

Example

Register#

Parameters

Example

Learn more

Set a new password#

Parameters

Example

Create a login token#

Parameters

Example

Revoke an app’s access#

Parameters

Example

Learn more

Revoke access tokens#

Parameters

Example

Learn more