Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
User management and authentication endpoints
/api/user
Source: src/routes/user.route.ts
| Method | Path | Auth | Description |
|---|---|---|---|
POST | / | isAdmin | Create a new user (or restore a soft-deleted user with the same email) |
GET | / | isAdmin | Get the authenticated admin’s own profile |
GET | /getAll | isAdmin | List all non-deleted users with pagination (skip, limit query params) |
DELETE | /:id | isAdmin | Soft-delete a user (deleted: true, clears session) |
PATCH | /activeInactive/:id | isAdmin | Toggle isActive for a user |
| Method | Path | Auth | Description |
|---|---|---|---|
PUT | / | isToken() | Update user profile, role, page access, MFA settings, or UI tab preferences |
POST | /logout/:id | isToken() | Log out user — clears loginToken and isLoggedIn |
POST | /verify-mfa | isToken() | Verify TOTP OTP and set isMfaVerified: true |
GET | /verifyToken | isToken() | Return full user document with populated pageAccess |
PUT | /resetPassword | isToken() | Change password (requires old, new, and confirm password) |
| Method | Path | Auth | Description |
|---|---|---|---|
POST | /login | None | Authenticate with email + password (or OTP for MFA users) |
POST | /check-mfa | None | Return MFA status for a given email |
PUT | /forgetPassword | None | Reset password with old and new credentials |
PUT | /forgetPasswordMail | None | Send forgot-password email (same validator as forget password) |
| Endpoint | Validator | Key fields |
|---|---|---|
POST / | createUser | firstName, lastName, email, password, role, pageAccess[] |
PUT / | updateUser | _id required; optional profile, role, pageAccess, tab prefs |
POST /login | loginValidator | email, password; optional role, isForceLogin |
PUT /resetPassword | resetPasswordValidator | _id, oldPassword, newPassword, confirmPassword |
PUT /forgetPassword | forgotPasswordValidator | _id, oldPassword, newPassword, confirmPassword |
403 with userLoggedIn: true if the email is already logged in and isForceLogin is not set.isMfaVerified) submit their TOTP code as the password field.loginToken and populates pageAccess with active index settings.