PATCH
/v1/mgmt/user/patch/batch

Authorization

Descope Project ID and Management Key
AuthorizationBearer <token>

Project ID:Management Key as bearer token.

In: header

Request Body

application/json

users?array<PatchUserRequest>

Patch users in batch, using a valid management key.

curl -X PATCH "https://api.descope.com/v1/mgmt/user/patch/batch" \  -H "Content-Type: application/json" \  -d '{}'
{  "patchedUsers": [    {      "loginIds": [        "string"      ],      "userId": "string",      "name": "string",      "email": "string",      "phone": "string",      "verifiedEmail": true,      "verifiedPhone": true,      "roleNames": [        "string"      ],      "userTenants": [        {          "tenantId": "string",          "roleNames": [            "string"          ],          "tenantName": "string",          "permissions": [            "string"          ],          "roleIds": [            "string"          ]        }      ],      "status": "string",      "externalIds": [        "string"      ],      "picture": "string",      "test": false,      "customAttributes": {        "attribute-key": "attribute-value"      },      "createdTime": 0,      "TOTP": false,      "SAML": false,      "OAuth": {        "property1": false,        "property2": false      },      "webauthn": true,      "password": true,      "ssoAppIds": [        "string"      ],      "givenName": "string",      "middleName": "string",      "familyName": "string",      "editable": true,      "SCIM": true,      "push": true,      "permissions": [        "string"      ],      "OIDC": true,      "consentExpiration": 0,      "recoveryEmail": "string",      "verifiedRecoveryEmail": true,      "recoveryPhone": "string",      "verifiedRecoveryPhone": true,      "modifiedTime": 0,      "roleIds": [        "string"      ],      "recoveryCodes": true,      "dependent": true,      "userFamilies": [        {          "familyId": "string",          "roleNames": [            "string"          ],          "permissions": [            "string"          ],          "familyScopedAttributes": {}        }      ],      "lockReason": "string",      "tempLockExpiration": 0,      "scimTenantId": "string",      "samlTenantId": "string",      "oidcTenantId": "string",      "consentTenantId": "string",      "lastLoginTime": 0    }  ],  "failedUsers": [    {      "failure": "string",      "user": {        "loginIds": [          "string"        ],        "userId": "string",        "name": "string",        "email": "string",        "phone": "string",        "verifiedEmail": true,        "verifiedPhone": true,        "roleNames": [          "string"        ],        "userTenants": [          {            "tenantId": "string",            "roleNames": [              "string"            ],            "tenantName": "string",            "permissions": [              "string"            ],            "roleIds": [              "string"            ]          }        ],        "status": "string",        "externalIds": [          "string"        ],        "picture": "string",        "test": false,        "customAttributes": {          "attribute-key": "attribute-value"        },        "createdTime": 0,        "TOTP": false,        "SAML": false,        "OAuth": {          "property1": false,          "property2": false        },        "webauthn": true,        "password": true,        "ssoAppIds": [          "string"        ],        "givenName": "string",        "middleName": "string",        "familyName": "string",        "editable": true,        "SCIM": true,        "push": true,        "permissions": [          "string"        ],        "OIDC": true,        "consentExpiration": 0,        "recoveryEmail": "string",        "verifiedRecoveryEmail": true,        "recoveryPhone": "string",        "verifiedRecoveryPhone": true,        "modifiedTime": 0,        "roleIds": [          "string"        ],        "recoveryCodes": true,        "dependent": true,        "userFamilies": [          {            "familyId": "string",            "roleNames": [              "string"            ],            "permissions": [              "string"            ],            "familyScopedAttributes": {}          }        ],        "lockReason": "string",        "tempLockExpiration": 0,        "scimTenantId": "string",        "samlTenantId": "string",        "oidcTenantId": "string",        "consentTenantId": "string",        "lastLoginTime": 0      }    }  ],  "additionalErrors": {    "property1": "string",    "property2": "string"  }}
export interface Response {patchedUsers?: {loginIds?: string[]userId?: stringname?: stringemail?: stringphone?: stringverifiedEmail?: booleanverifiedPhone?: booleanroleNames?: string[]userTenants?: UserTenants[]status?: stringexternalIds?: string[]picture?: stringtest?: boolean/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}createdTime?: numberTOTP?: booleanSAML?: booleanOAuth?: {[k: string]: boolean}webauthn?: booleanpassword?: booleanssoAppIds?: string[]givenName?: stringmiddleName?: stringfamilyName?: stringeditable?: booleanSCIM?: booleanpush?: booleanpermissions?: string[]OIDC?: booleanconsentExpiration?: numberrecoveryEmail?: stringverifiedRecoveryEmail?: booleanrecoveryPhone?: stringverifiedRecoveryPhone?: booleanmodifiedTime?: number/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match *  roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]/** * whether the user has set up recovery codes */recoveryCodes?: booleandependent?: booleanuserFamilies?: UserFamilies[]lockReason?: stringtempLockExpiration?: number/** * scimTenantId is the tenant whose SCIM connection provisioned the user, empty when none or ambiguous. */scimTenantId?: string/** * samlTenantId is the tenant whose SAML SSO created the user or merged the user's login into it, empty when none or ambiguous. */samlTenantId?: string/** * oidcTenantId is the tenant whose OIDC SSO created the user or merged the user's login into it, empty when none or ambiguous. */oidcTenantId?: stringconsentTenantId?: string/** * lastLoginTime is the epoch time (in seconds) of the last time this user authenticated, 0 when the user has never logged in. *  On a response that completes a sign-in - a flow, an OTP or password verification, an SSO exchange - this is the sign-in BEFORE *  the current one, and it is 0 for a user signing in for the first time: the sign-in in progress is recorded after the response is *  produced. Read the user again through Load User or My Details to get the sign-in that just completed. */lastLoginTime?: number}[]failedUsers?: PatchUserBatchFailureResponse[]additionalErrors?: {[k: string]: string}}export interface UserTenants {tenantId?: stringroleNames?: string[]tenantName?: stringpermissions?: string[]/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match *  roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]}export interface UserFamilies {familyId?: stringroleNames?: string[]permissions?: string[]familyScopedAttributes?: {}}export interface PatchUserBatchFailureResponse {failure?: stringuser?: {loginIds?: string[]userId?: stringname?: stringemail?: stringphone?: stringverifiedEmail?: booleanverifiedPhone?: booleanroleNames?: string[]userTenants?: UserTenants[]status?: stringexternalIds?: string[]picture?: stringtest?: boolean/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}createdTime?: numberTOTP?: booleanSAML?: booleanOAuth?: {[k: string]: boolean}webauthn?: booleanpassword?: booleanssoAppIds?: string[]givenName?: stringmiddleName?: stringfamilyName?: stringeditable?: booleanSCIM?: booleanpush?: booleanpermissions?: string[]OIDC?: booleanconsentExpiration?: numberrecoveryEmail?: stringverifiedRecoveryEmail?: booleanrecoveryPhone?: stringverifiedRecoveryPhone?: booleanmodifiedTime?: number/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match *  roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]/** * whether the user has set up recovery codes */recoveryCodes?: booleandependent?: booleanuserFamilies?: UserFamilies[]lockReason?: stringtempLockExpiration?: number/** * scimTenantId is the tenant whose SCIM connection provisioned the user, empty when none or ambiguous. */scimTenantId?: string/** * samlTenantId is the tenant whose SAML SSO created the user or merged the user's login into it, empty when none or ambiguous. */samlTenantId?: string/** * oidcTenantId is the tenant whose OIDC SSO created the user or merged the user's login into it, empty when none or ambiguous. */oidcTenantId?: stringconsentTenantId?: string/** * lastLoginTime is the epoch time (in seconds) of the last time this user authenticated, 0 when the user has never logged in. *  On a response that completes a sign-in - a flow, an OTP or password verification, an SSO exchange - this is the sign-in BEFORE *  the current one, and it is 0 for a user signing in for the first time: the sign-in in progress is recorded after the response is *  produced. Read the user again through Load User or My Details to get the sign-in that just completed. */lastLoginTime?: number}}
Was this helpful?