User & notifications

The authenticated user — profile, locale, connected sign-in accounts, referrals — and their notifications, including accepting project invitations.

These endpoints act on the authenticated user, the person who authorized your application. There is no way to read another user's profile.

Field types follow the field notation.

Access

Every endpoint on this page requires the identify OAuth scope.

User Object

User Structure

Example User

{
  "uuid": "0198e7aa-91f0-7c22-a4d1-0f9e8d7c6b5a",
  "email": "[email protected]",
  "given_name": "Anna",
  "family_name": "Petrova",
  "phone": "+1 555 010 2000",
  "country": "US",
  "city": "Springfield",
  "address": "",
  "postcode": "",
  "company": "Acme Windows",
  "locale": "en",
  "timezone": "America/Chicago",
  "is_allow_mail": false,
  "type": "regular",
  "status": "active",
  "referral_uuid": null,
  "is_partner_client": false,
  "partner_percent": 0,
  "balance": 0,
  "credit_limit": 0,
  "created_at": "2026-06-26T09:55:00.000Z",
  "updated_at": "2026-09-01T12:00:00.000Z"
}

Get Current User

GET /api/v1/user

Returns the user.

Modify Current User

PATCH /api/v1/user

Updates any of given_name, family_name, phone, country, city, address, postcode, company, locale (up to 8 characters), timezone (up to 128 characters), is_allow_mail. At least one must be present. Email and password cannot be changed by third-party applications.

PUT /api/v1/user does the same but requires all of these fields.

Example Request

{
  "given_name": "Anna",
  "timezone": "Europe/Berlin"
}

Response

204 No Content

Get Current User Locale

GET /api/v1/user/locale

{
  "locale": "en",
  "timezone": "America/Chicago"
}

Connected Accounts

Third-party sign-in providers linked to the account.

List Connected Accounts

GET /api/v1/user/oauth

[
  {
    "provider": "google",
    "provider_email": "[email protected]",
    "created_at": "2026-06-26T09:55:00.000Z"
  }
]

Disconnect Account

DELETE /api/v1/user/oauth/{provider}

Unlinks a provider. Refused with 403 AUTH_NO_ACCESS if it is the user's only way to sign in: no password and no other provider. 204 No Content.

List Referrals

GET /api/v1/user/referrals

Users who signed up through this user's referral link, oldest first.

[
  {
    "uuid": "0199b2bb-0000-7000-8000-000000000001",
    "user_name": "Ivan Sidorov",
    "created_at": "2026-08-01T10:00:00.000Z"
  }
]

Notifications

Notifications are personal: they belong to the user, not to a project. A project only gives context.

Notification Structure

Notifications are deleted after 30 days.

List Notifications

GET /api/v1/user/notifications

Returns the newest notifications and the total unread count:

{
  "items": [
    {
      "uuid": "0199b3cc-0000-7000-8000-000000000001",
      "type": "project_invitation",
      "payload": {
        "role_uuid": "0198e7a0-0000-7000-8000-0000000000a2",
        "role_name": "Manager",
        "project_name": "Acme Windows",
        "invited_by": "0198e7aa-91f0-7c22-a4d1-0f9e8d7c6b5a"
      },
      "status": "pending",
      "project_uuid": "0198e7a0-0000-7000-8000-000000000001",
      "project_name": "Acme Windows",
      "entity_type": null,
      "entity_uuid": null,
      "read_at": null,
      "resolved_at": null,
      "created_at": "2026-10-01T08:00:00.000Z"
    }
  ],
  "unread_count": 1
}

Mark All Notifications Read

PATCH /api/v1/user/notifications with body {"mark_all_read": true}. 204 No Content.

Mark Notification Read

PATCH /api/v1/user/notifications/{notification.uuid} with body {"read": true}, or {"read": false} to mark it unread. 204 No Content.

Dismiss Notification

DELETE /api/v1/user/notifications/{notification.uuid}. 204 No Content.

Answer Notification

POST /api/v1/user/notifications/{notification.uuid}/actions

Accepts or rejects an actionable notification. Accepting a project_invitation makes the user a member of the project with the invited role.

200 OK:

{
  "status": "accepted"
}

Errors