Users
APIs related to user management.
📄️ List notification events
Returns the caller's in-app notification events. No system-settings check. Also records a user-session audit entry.
📄️ Mark notification events read or unread
Marks the caller's events read or unread. No system-settings check. First id all updates every matching event from the last six months. Unknown ids stay 200 with a partial Message.
📄️ Get users list
List of all users that exist in the system
📄️ Create user
Creates a user in different services, if the user doesn't exist
📄️ Get user access parity report
Get user access parity report
📄️ Datasets access grants report
Access grants for both user and group level of the datasets
📄️ Datasets access grants report
Access grants for both user and group level of the datasets
📄️ Get user
Get user by id. Use action=user-devices to return active Cognito devices for the user.
📄️ Deletes the user
Deletes the user and transfer resource ownership
📄️ Details about user resources
Get details about resources owned by user. Provide either resourceType or action=get-valid-resources. User resource metadata repair/report is available via POST /metadata-repair/users.
📄️ Perform user lifecycle and admin operations
Supports enable/disable, disable-mfa, user-agreement, global-signout, and add/remove-super-admin via the operation query parameter.
📄️ Assume Service User
Generates the Short Context Token. Signs token using the Global KMS Key.
📄️ Update user UI preferences
Api to update user Preferences
📄️ Reset dwh password
A user can reset dwh password
📄️ Update user default role
Update user default role
📄️ Detach user role
On request detach the access role for the user
📄️ Get email alert subscription status
Returns the calling user's email-alert subscription status. Body is {'Message': '<status>'} where status is yes (subscribed), no (not subscribed / default when EmailSubscription is unset), or pending (SES verification in flight). When no SMTP mail server is enabled, GET may check SES identity verification and persist yes/pending back to the user record (not purely read-only). DynamoDB update failure returns GE-1020 (HTTP 400).
📄️ Subscribe to email alerts
Subscribes the calling user to email alerts. No request body. SMTP available: EmailSubscription is set to yes immediately. Otherwise SES sends a verification email and status is pending. Success Message is the confirmation-email text. If already subscribed, Message states the user is already subscribed. Pending re-subscribe within 5 minutes returns GE-1034 (HTTP 500). Service users return GE-1014.
📄️ Unsubscribe from email alerts
Unsubscribes the calling user from email alerts. No request body. Service users return GE-1014. Success Message is 'Successfully Unsubscribed from email alerts. You will not receive any system alerts to your email anymore.' Repeat DELETE still succeeds.
📄️ Update notification preferences
Saves email and push preferences for the caller. No system-settings check. custom_email_address=yes writes a custom email identity instead of the caller. UserId in the body is overwritten from the token.
📄️ List notification preferences
Lists the caller's preferences for one resource type, or custom alert emails when resource_type is custom-alert-emails (requires system-settings.view).
📄️ Delete notification preferences
Removes custom-email rows for a resource, or deletes one custom alert email when resource_type is custom-alert-emails (requires system-settings.fullaccess).
📄️ Get system alert subscription status
Returns the caller's SNS email subscription for system alerts. Requires users.manage and system-settings.view. May update the user record when a pending confirmation has completed, or when the SNS subscription no longer exists.
📄️ Subscribe or unsubscribe from system alerts
subscribe sends an SNS confirmation email (Cognito email claim). unsubscribe drops a confirmed subscription. Requires users.manage and system-settings.view. Subscribe is not idempotent while pending (5-minute resend window). Already subscribed or already unsubscribed still return 200.
📄️ Get status of bulk user creation
Returns status of bulk user creation
📄️ Create user by admin
Creates a user in cognito
📄️ List access requests for the user
Returns access requests for the calling user. By default, the response includes RequestsSent and RequestsReceived, grouped by resource type. Optional filters include RequestType, ResourceType, and RequestStatus,
📄️ Delete a pending access request
Deletes a pending access request. Loads the request by RequestId then validates role authorization for its ResourceType. Only the original RequestedBy user may delete it, and RequestStatus must be requested (else AUTH-1021). Missing request returns GE-1080. Success Message is 'Successfully deleted access request.' Not idempotent after delete (subsequent calls return GE-1080).