Users API

GET/v1/users

Returns the workspace roster: each person's role, which locations they can access, their sign-in method, two-factor authentication status, and last login. **Notes.** - Not paginated. Deleted (erased) people are not listed. A caller whose access is limited to some locations sees only the people with access there, and only those locations in access.

curl "https://api.brixsignage.com/v1/users" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The token lacks the permission this operation needs (see `x-brix-permission`).

Response 5XX Server error. The body carries a `requestId` to quote to support.

PATCH/v1/users/{id}

Updates a person's profile. Supported fields are name and trainingStep (which resets a feature walkthrough for that person). Email address and account status cannot be changed through this operation. Requires access to every location the target person belongs to.

Request body application/json

curl -X PATCH "https://api.brixsignage.com/v1/users/{id}" \
  -H "Authorization: Bearer $BRIX_API_KEY" \
  -H "Content-Type: application/json"

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The person belongs to a location where you do not hold `user.edit`.

Response 404 No such person in this workspace.

Response 422 Nothing to update, an empty or over-long `name`, or an unknown `trainingStep`.

Response 5XX Server error. The body carries a `requestId` to quote to support.

POST/v1/users/{id}/deactivate

Deactivates a person's account. This revokes all of their active sessions, signing them out everywhere immediately and blocking further sign-in including through SSO, and removes them from every location's approver list. This action is reversible. You cannot deactivate your own account or the last remaining account owner. Only an account owner can do this to an owner, and you cannot do it to a person who holds a permission you do not hold. An API key is never an owner. **Notes.** - Only an owner can deactivate an owner, and nobody can deactivate a person who holds a permission they do not hold. An API key is never an owner, whatever its permissions.

curl -X POST "https://api.brixsignage.com/v1/users/{id}/deactivate" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The person belongs to a location where you do not hold `user.edit`; `owner_required`: the person is an owner and you are not an owner there (an API key is never an owner); or `outranked`: the person holds a permission you do not hold where they hold it.

Response 404 No such person in this workspace.

Response 409 `cant_deactivate_self`, `already_deactivated`, or `last_owner` (the last owner of the workspace or of a location).

Response 5XX Server error. The body carries a `requestId` to quote to support.

POST/v1/users/{id}/erase

Permanently erases a deactivated person's personal data to satisfy a right-to-be-forgotten request: it anonymizes their profile and hard-deletes their passkeys, linked identities, sessions, and location role assignments. The account must already be deactivated. You cannot erase your own account or the last remaining account owner. Only an account owner can do this to an owner, and you cannot do it to a person who holds a permission you do not hold. An API key is never an owner. **Notes.** - Irreversible. The same rule as deactivation applies: only an owner can erase an owner, and the caller must hold every permission the person holds.

curl -X POST "https://api.brixsignage.com/v1/users/{id}/erase" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The person belongs to a location where you do not hold `user.edit`; `owner_required`: the person is an owner and you are not an owner there (an API key is never an owner); or `outranked`: the person holds a permission you do not hold where they hold it.

Response 404 No such person in this workspace (an erased person is not found again).

Response 409 `cant_erase_self`, `last_owner`, or `must_deactivate_first`.

Response 5XX Server error. The body carries a `requestId` to quote to support.

POST/v1/users/{id}/reactivate

Restores a deactivated person's account to active status. Their previous role assignments are restored along with the access they grant. Any approver-list entries removed at deactivation are not automatically restored. Only an account owner can do this to an owner, and you cannot do it to a person who holds a permission you do not hold. An API key is never an owner.

curl -X POST "https://api.brixsignage.com/v1/users/{id}/reactivate" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The person belongs to a location where you do not hold `user.edit`; `owner_required`: the person is an owner and you are not an owner there (an API key is never an owner); or `outranked`: the person holds a permission you do not hold where they hold it.

Response 404 No such person in this workspace.

Response 409 `not_deactivated`: the person is not deactivated.

Response 5XX Server error. The body carries a `requestId` to quote to support.

GET/v1/users/{id}/sessions

Returns a person's currently active sign-in sessions: id, creation time, last used time, expiry, device or browser, IP address, and which session belongs to the caller. Revoked and expired sessions are not included. **Notes.** - Needs user.edit, not user.view: the rows carry IP addresses. Sorted by last use, newest first.

curl "https://api.brixsignage.com/v1/users/{id}/sessions" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The person belongs to a location where you do not hold `user.edit`.

Response 404 No such person in this workspace.

Response 5XX Server error. The body carries a `requestId` to quote to support.

DELETE/v1/users/{id}/sessions/{sessionId}

Signs one of a person's devices out by revoking that session. The session record itself is kept, not deleted. Calling this on an already-revoked session is safe and reports revoked: false.

curl -X DELETE "https://api.brixsignage.com/v1/users/{id}/sessions/{sessionId}" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The person belongs to a location where you do not hold `user.edit`.

Response 404 No such person, or no such session for this person.

Response 5XX Server error. The body carries a `requestId` to quote to support.

POST/v1/users/{id}/sessions/revoke-all

Signs a person out of every active session without deactivating their account, so they can still sign back in afterward. Returns the number of sessions that were revoked.

curl -X POST "https://api.brixsignage.com/v1/users/{id}/sessions/revoke-all" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The person belongs to a location where you do not hold `user.edit`.

Response 404 No such person in this workspace.

Response 5XX Server error. The body carries a `requestId` to quote to support.

POST/v1/users/invite

Creates a new person in the workspace, or reuses an existing one, and assigns them a role at the chosen locations. A new person gets an email with a link to set their password. When a signed-in user sends the invite, the email goes out only when that user's own email address is verified. An invite made with an API key sends the email in the workspace's name. You cannot grant a role carrying permissions you do not hold yourself. **Notes.** - Answers 200 (not 201) for a new person too; created tells the two apart. - For a signed-in user, the set-password email is sent only when that user's own email address is verified. An invite made with an API key sends the email too, from the workspace (the key's name is not shown). The 30-a-minute limit counts per key for a key.

Request body application/json

curl -X POST "https://api.brixsignage.com/v1/users/invite" \
  -H "Authorization: Bearer $BRIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","name":"Sam Rivera","roleId":"role_5e6f7a8b9c0d1e2f","nodeIds":["on_4d5e6f7a8b9c0d1e"]}'

Response 200 Success.

Response 401 Missing, expired or revoked bearer token.

Response 403 The role holds permissions you do not hold, or you lack `user.edit` or the role's permissions at one of the locations.

Response 404 No such role or location in this workspace.

Response 422 Invalid `email`, or `roleId` / `nodeIds` missing.

Response 429 More than 30 invites a minute.

Response 5XX Server error. The body carries a `requestId` to quote to support.