Permissions
Use the following permissions to get an access token for the machine-to-machine applications. To learn more, read Register Machine-to-Machine Applications.| Permissions | Descriptions |
|---|---|
read:users | Applications can search and retrieve any user records stored in an Auth0 tenant. This includes reading via the /api/v2/users , /api/v2/users-by-email, and /api/v2/jobs/users-export endpoints. |
create:users | Applications can create users in any database or passwordless connection in an Auth0 tenant. This includes creating via the /api/v2/users and /api/v2/jobs/users-import endpoints.The /api/v2/users endpoint also requires the client ID to be added to the enabled_clients property of the connection, similar to the sign-up endpoint. |
update:users | Applications can update any user stored in an Auth0 tenant. This includes updating via the /api/v2/users endpoint. |
update:users_app_metadata | Applications can update only the user.app_metadata attribute for any user stored in an Auth0 tenant. This includes updating via the /api/v2/users endpoint. |
delete:users | Applications can delete any user stored in an Auth0 tenant. This includes deleting via the /api/v2/users endpoint. |
Limitations
By default, user profile attributes provided by other than Auth0 (such as Google, Facebook, or X) are not directly editable because they are updated from the identity provider each time the user logs in. Fore more information on attributes from identity providers, read Configure Identity Provider Connection for User Profile Updates. To be able to edit thename, nickname, given_name, family_name, or picture root attributes on the normalized user profile, you must configure your connection sync with Auth0 so that user attributes will be updated from the identity provider only on user profile creation. These root attributes will then be available to be edited individually or by bulk imports
You can set passwords using the create or update endpoints, but for security purposes, passwords cannot be viewed with the get or list user commands. The right side of the API explorer provides hints on the user profile attributes which can be viewed or modified for any given call.
Endpoints
- Use the
/usersendpoint to retrieve information about all users. You can also include search criteria to find specific users. - Use the
/user_idto retrieve information about one user based on theuser_id. Theuser_idis an internal identifier that consists of a connection name and a unique identifier for the user. Theuser_idis different from the . - The
/userinfoendpoint takes as input the Auth0 access token and returns user profile information. This endpoint will include the results of any rules that may have altered the user profile during the authentication transaction, but the resulting user profile will not be filtered by any Scoping. - The
/tokeninfoendpoint takes as input the Auth0 ID token and returns user profile information. This endpoint will return a result that does not include the results of any rules that alter the user profile.