Users

The users API lets you manage the authenticated user’s profile, password, profile image, and identities (email and phone). All endpoints operate on the currently authenticated user via /users/me.

Endpoints

Get Current User

GET /api/v2/users/me

Returns the authenticated user’s profile, including their identities.

Response

{
  "id": 7,
  "created_at": "2024-01-15T08:30:00Z",
  "first_name": "Ola",
  "last_name": "Nordmann",
  "profile_image_url": "https://cdn.snapbooks.no/profile-images/abc123.jpg",
  "last_login": "2026-03-31T14:22:00Z",
  "identities": [
    {
      "type": "email",
      "value": "ola@example.com",
      "verified": true
    },
    {
      "type": "phone",
      "value": "+4791234567",
      "verified": false
    }
  ]
}

Update Current User

PATCH /api/v2/users/me

Updates the authenticated user’s first name and/or last name.

Request Body

Example Request

{
  "first_name": "Ola",
  "last_name": "Nordmann"
}

Response

Returns the updated user object (same shape as GET /users/me).

Change Password

POST /api/v2/users/me/change-password

Changes the authenticated user’s password. Rate limited to 5 requests per hour.

Request Body

Password Requirements

• Minimum 8 characters
• Must contain at least one uppercase letter
• Must contain at least one lowercase letter
• Must contain at least one number
• Must be different from the current password

Example Request

{
  "password": "OldPass123",
  "new_password": "NewSecure456"
}

Response

{
  "message": "Password changed successfully"
}

Error Responses

Upload Profile Image

POST /api/v2/users/me/profile-image

Uploads a new profile image for the authenticated user. The request must use multipart/form-data encoding.

Request Body

Allowed Content Types

• image/jpeg
• image/jpg
• image/png
• image/webp

Response

Returns the updated user object with the new profile_image_url.

Error Responses

Remove Profile Image

DELETE /api/v2/users/me/profile-image

Removes the authenticated user’s profile image.

Response

Returns the updated user object with profile_image_url set to null.

List Identities

GET /api/v2/users/me/identities

Returns the authenticated user’s identities (email and phone number).

Response

Returns the user object with the identities array populated. See the response example in Get Current User.

Add an Identity

POST /api/v2/users/me/identities

Adds a phone number identity to the authenticated user. Email changes are not supported through this endpoint.

Request Body

Example Request

{
  "type": "phone",
  "value": "+4791234567"
}

Response

Returns the updated user object with identities.

Error Responses

Remove an Identity

DELETE /api/v2/users/me/identities

Removes a phone number identity from the authenticated user. Email cannot be removed.

Request Body

Example Request

{
  "type": "phone"
}

Response

Returns the updated user object with identities.

Error Responses

Request Identity Verification

POST /api/v2/users/me/identities/verify

Sends a verification email to the authenticated user. Rate limited to 5 requests per hour. Only email verification is currently supported.

Request Body

Example Request

{
  "type": "email",
  "value": "ola@example.com"
}

Response

{
  "message": "Verification email sent"
}

Error Responses

Attributes

Identity

Error Codes

Errors use the standard error envelope. Branch on code, not on message. In addition to the common codes, the /users/me endpoints return:

Example Error Response

{
    "error": {
        "code": "user.weak_password",
        "message": "Password must be at least 8 characters with uppercase, lowercase, and a number",
        "request_id": "a1b2c3d4-5678-90ab-cdef-1234567890ab"
    }
}

Related Resources

• Client Accounts — companies the user has access to
• Invitations — invite users to join client accounts
• Authentication — OAuth2 authentication flow