Authentication: User Management · Innovorder API Documentation

Role Requirement

These endpoints require the brand or restaurant role unless otherwise noted.

Manage backoffice users within your brand or restaurant scope. Brand users can create and manage restaurant-level users, while restaurant users have limited management capabilities within their assigned locations.

List Users

GET`/users`Get All Users

Retrieve all users matching the specified filters. Brand users can list users for their brand; restaurant users can list users for their assigned restaurants.

Parameters

Name	Type	Required	Description
role	string	Yes	Filter by user role (e.g. "brand", "restaurant").
brandId	integer	No	Filter by brand ID.
include_disabled	boolean	No	Include disabled user accounts. Defaults to false.
restaurantsId	string	No	Comma-separated list of restaurant IDs to filter by.
search	string	No	Search term to filter users by name or email.
orderByLastConnection	boolean	No	Order results by last connection date.

Response

json

{
  "status": 200,
  "code": "users_succeed",
  "message": "You can access to those users.",
  "data": [
    {
      "userId": 100500,
      "email": "manager@example.com",
      "firstName": "Jane",
      "lastName": "Doe",
      "phone": "0612345678",
      "role": "restaurant",
      "brandId": 100
    }
  ]
}

Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
status	integer	200	HTTP status code returned by the API.
code	string	"users_succeed"	Machine-readable application code for the result.
message	string	"You can access to those users."	Human-readable result message. Do not use this value for program logic.
data	array	[…]	Endpoint-specific response payload.
data[]	object	{…}	Endpoint-specific response payload.
data[].userId	integer	100500	Identifier of the user.
data[].email	string	"manager@example.com"	Email address.
data[].firstName	string	"Jane"	The first name value.
data[].lastName	string	"Doe"	The last name value.
data[].phone	string	"0612345678"	Phone number.
data[].role	string	"restaurant"	The role value.
data[].brandId	integer	100	Identifier of the brand.

Create User

POST`/users/manager`Create a Manager User

Create a new backoffice user (brand or restaurant manager). If letUserChoosePassword is true, the password must be null and the user will receive an activation email to set their own password.

Request Body

json

{
  "brandId": 100,
  "email": "newuser@example.com",
  "password": "securePassword123",
  "firstName": "John",
  "lastName": "Smith",
  "phone": "0612345678",
  "role": "restaurant",
  "restaurantId": 200,
  "letUserChoosePassword": false
}

Request Body Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
brandId	integer	100	Identifier of the brand.
email	string	"newuser@example.com"	Email address.
password	string	"securePassword123"	The password value.
firstName	string	"John"	The first name value.
lastName	string	"Smith"	The last name value.
phone	string	"0612345678"	Phone number.
role	string	"restaurant"	The role value.
restaurantId	integer	200	Identifier of the restaurant.
letUserChoosePassword	boolean	false	The let user choose password value.

Response

json

{
  "status": 201,
  "code": "user_create_succeed",
  "message": "User has been successfully created.",
  "data": {
    "userId": 100501,
    "email": "newuser@example.com",
    "firstName": "John",
    "lastName": "Smith",
    "phone": "0612345678",
    "role": "restaurant",
    "brandId": 100
  }
}

Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
status	integer	201	HTTP status code returned by the API.
code	string	"user_create_succeed"	Machine-readable application code for the result.
message	string	"User has been successfully created."	Human-readable result message. Do not use this value for program logic.
data	object	{…}	Endpoint-specific response payload.
data.userId	integer	100501	Identifier of the user.
data.email	string	"newuser@example.com"	Email address.
data.firstName	string	"John"	The first name value.
data.lastName	string	"Smith"	The last name value.
data.phone	string	"0612345678"	Phone number.
data.role	string	"restaurant"	The role value.
data.brandId	integer	100	Identifier of the brand.

Update User

PUT`/users/{userId}`Update User by ID

Update an existing user's profile information. All body fields are optional. Only the fields provided will be updated.

Parameters

Name	Type	Required	Description
userId	string	Yes	The ID of the user to update.

Request Body

json

{
  "email": "updated@example.com",
  "firstName": "Jane",
  "lastName": "Doe",
  "phone": "0698765432",
  "role": "restaurant"
}

Request Body Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
email	string	"updated@example.com"	Email address.
firstName	string	"Jane"	The first name value.
lastName	string	"Doe"	The last name value.
phone	string	"0698765432"	Phone number.
role	string	"restaurant"	The role value.

Response

json

{
  "status": 200,
  "code": "user_update_succeed",
  "message": "User has been successfully updated.",
  "data": {
    "userId": 100501,
    "email": "updated@example.com",
    "firstName": "Jane",
    "lastName": "Doe",
    "phone": "0698765432",
    "role": "restaurant",
    "brandId": 100,
    "access_flags": {}
  }
}

Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
status	integer	200	HTTP status code returned by the API.
code	string	"user_update_succeed"	Machine-readable application code for the result.
message	string	"User has been successfully updated."	Human-readable result message. Do not use this value for program logic.
data	object	{…}	Endpoint-specific response payload.
data.userId	integer	100501	Identifier of the user.
data.email	string	"updated@example.com"	Email address.
data.firstName	string	"Jane"	The first name value.
data.lastName	string	"Doe"	The last name value.
data.phone	string	"0698765432"	Phone number.
data.role	string	"restaurant"	The role value.
data.brandId	integer	100	Identifier of the brand.
data.access_flags	object	{…}	Object containing access flags fields.

Assign Restaurants to User

PUT`/users/{userId}/restaurants/bulk`Override Assigned Restaurants

Replace all restaurant assignments for a user. Brand users must have the CAN_MANAGE_BO_USERS access flag and ownership of the specified restaurants. This is a full replacement -- any restaurants not included will be unassigned.

Parameters

Name	Type	Required	Description
userId	string	Yes	The ID of the user whose restaurants to override.

Request Body

json

{
  "restaurantIds": [
    200,
    201,
    202
  ]
}

Request Body Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
restaurantIds	array	[…]	List of restaurant ids entries.
restaurantIds[]	integer	200	The restaurant ids value.

Response

json

{
  "status": 200,
  "code": "success",
  "message": "Success"
}

Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
status	integer	200	HTTP status code returned by the API.
code	string	"success"	Machine-readable application code for the result.
message	string	"Success"	Human-readable result message. Do not use this value for program logic.

Get User Restaurants

GET`/users/{userId}/restaurants`Get Restaurants Assigned to a User

Retrieve the list of restaurants assigned to a specific user. Brand users must have the CAN_MANAGE_BO_USERS access flag, and the target user must belong to the same brand.

Parameters

Name	Type	Required	Description
userId	integer	Yes	The ID of the user.

Response

json

{
  "status": 200,
  "code": "user_restaurants_succeed",
  "message": "You can access to those user restaurants.",
  "data": [
    {
      "restaurantId": 200,
      "name": "Innovorder Burgers Paris"
    },
    {
      "restaurantId": 201,
      "name": "Innovorder Burgers Lyon"
    }
  ]
}

Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
status	integer	200	HTTP status code returned by the API.
code	string	"user_restaurants_succeed"	Machine-readable application code for the result.
message	string	"You can access to those user restaurants."	Human-readable result message. Do not use this value for program logic.
data	array	[…]	Endpoint-specific response payload.
data[]	object	{…}	Endpoint-specific response payload.
data[].restaurantId	integer	200	Identifier of the restaurant.
data[].name	string	"Innovorder Burgers Paris"	The name value.