# User Management

Role Requirement

These endpoints require the `brand` or `restaurant` role unless otherwise noted.

Manage backoffice users within your brand or restaurant scope. Brand users can create and manage restaurant-level users, while restaurant users have limited management capabilities within their assigned locations.

### List Users

### `GET /users` - Get All Users

Retrieve all users matching the specified filters. Brand users can list users for their brand; restaurant users can list users for their assigned restaurants.

#### Parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| role | string | Yes | Filter by user role (e.g. "brand", "restaurant"). |
| brandId | integer | No | Filter by brand ID. |
| include\_disabled | boolean | No | Include disabled user accounts. Defaults to false. |
| restaurantsId | string | No | Comma-separated list of restaurant IDs to filter by. |
| search | string | No | Search term to filter users by name or email. |
| orderByLastConnection | boolean | No | Order results by last connection date. |

#### Response

```json
{
  "status": 200,
  "code": "users_succeed",
  "message": "You can access to those users.",
  "data": [
    {
      "userId": 100500,
      "email": "manager@example.com",
      "firstName": "Jane",
      "lastName": "Doe",
      "phone": "0612345678",
      "role": "restaurant",
      "brandId": 100
    }
  ]
}
```

##### Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| status | integer | 200 | HTTP status code returned by the API. |
| code | string | "users\_succeed" | Machine-readable application code for the result. |
| message | string | "You can access to those users." | Human-readable result message. Do not use this value for program logic. |
| data | array | \[…\] | Endpoint-specific response payload. |
| data\[\] | object | {…} | Endpoint-specific response payload. |
| data\[\].userId | integer | 100500 | Identifier of the user. |
| data\[\].email | string | "manager@example.com" | Email address. |
| data\[\].firstName | string | "Jane" | The first name value. |
| data\[\].lastName | string | "Doe" | The last name value. |
| data\[\].phone | string | "0612345678" | Phone number. |
| data\[\].role | string | "restaurant" | The role value. |
| data\[\].brandId | integer | 100 | Identifier of the brand. |

### Create User

### `POST /users/manager` - Create a Manager User

Create a new backoffice user (brand or restaurant manager). If letUserChoosePassword is true, the password must be null and the user will receive an activation email to set their own password.

#### Request Body

```json
{
  "brandId": 100,
  "email": "newuser@example.com",
  "password": "securePassword123",
  "firstName": "John",
  "lastName": "Smith",
  "phone": "0612345678",
  "role": "restaurant",
  "restaurantId": 200,
  "letUserChoosePassword": false
}
```

##### Request Body Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| brandId | integer | 100 | Identifier of the brand. |
| email | string | "newuser@example.com" | Email address. |
| password | string | "securePassword123" | The password value. |
| firstName | string | "John" | The first name value. |
| lastName | string | "Smith" | The last name value. |
| phone | string | "0612345678" | Phone number. |
| role | string | "restaurant" | The role value. |
| restaurantId | integer | 200 | Identifier of the restaurant. |
| letUserChoosePassword | boolean | false | The let user choose password value. |

#### Response

```json
{
  "status": 201,
  "code": "user_create_succeed",
  "message": "User has been successfully created.",
  "data": {
    "userId": 100501,
    "email": "newuser@example.com",
    "firstName": "John",
    "lastName": "Smith",
    "phone": "0612345678",
    "role": "restaurant",
    "brandId": 100
  }
}
```

##### Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| status | integer | 201 | HTTP status code returned by the API. |
| code | string | "user\_create\_succeed" | Machine-readable application code for the result. |
| message | string | "User has been successfully created." | Human-readable result message. Do not use this value for program logic. |
| data | object | {…} | Endpoint-specific response payload. |
| data.userId | integer | 100501 | Identifier of the user. |
| data.email | string | "newuser@example.com" | Email address. |
| data.firstName | string | "John" | The first name value. |
| data.lastName | string | "Smith" | The last name value. |
| data.phone | string | "0612345678" | Phone number. |
| data.role | string | "restaurant" | The role value. |
| data.brandId | integer | 100 | Identifier of the brand. |

### Update User

### `PUT /users/{userId}` - Update User by ID

Update an existing user's profile information. All body fields are optional. Only the fields provided will be updated.

#### Parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| userId | string | Yes | The ID of the user to update. |

#### Request Body

```json
{
  "email": "updated@example.com",
  "firstName": "Jane",
  "lastName": "Doe",
  "phone": "0698765432",
  "role": "restaurant"
}
```

##### Request Body Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| email | string | "updated@example.com" | Email address. |
| firstName | string | "Jane" | The first name value. |
| lastName | string | "Doe" | The last name value. |
| phone | string | "0698765432" | Phone number. |
| role | string | "restaurant" | The role value. |

#### Response

```json
{
  "status": 200,
  "code": "user_update_succeed",
  "message": "User has been successfully updated.",
  "data": {
    "userId": 100501,
    "email": "updated@example.com",
    "firstName": "Jane",
    "lastName": "Doe",
    "phone": "0698765432",
    "role": "restaurant",
    "brandId": 100,
    "access_flags": {}
  }
}
```

##### Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| status | integer | 200 | HTTP status code returned by the API. |
| code | string | "user\_update\_succeed" | Machine-readable application code for the result. |
| message | string | "User has been successfully updated." | Human-readable result message. Do not use this value for program logic. |
| data | object | {…} | Endpoint-specific response payload. |
| data.userId | integer | 100501 | Identifier of the user. |
| data.email | string | "updated@example.com" | Email address. |
| data.firstName | string | "Jane" | The first name value. |
| data.lastName | string | "Doe" | The last name value. |
| data.phone | string | "0698765432" | Phone number. |
| data.role | string | "restaurant" | The role value. |
| data.brandId | integer | 100 | Identifier of the brand. |
| data.access\_flags | object | {…} | Object containing access flags fields. |

### Assign Restaurants to User

### `PUT /users/{userId}/restaurants/bulk` - Override Assigned Restaurants

Replace all restaurant assignments for a user. Brand users must have the CAN\_MANAGE\_BO\_USERS access flag and ownership of the specified restaurants. This is a full replacement -- any restaurants not included will be unassigned.

#### Parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| userId | string | Yes | The ID of the user whose restaurants to override. |

#### Request Body

```json
{
  "restaurantIds": [
    200,
    201,
    202
  ]
}
```

##### Request Body Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| restaurantIds | array | \[…\] | List of restaurant ids entries. |
| restaurantIds\[\] | integer | 200 | The restaurant ids value. |

#### Response

```json
{
  "status": 200,
  "code": "success",
  "message": "Success"
}
```

##### Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| status | integer | 200 | HTTP status code returned by the API. |
| code | string | "success" | Machine-readable application code for the result. |
| message | string | "Success" | Human-readable result message. Do not use this value for program logic. |

### Get User Restaurants

### `GET /users/{userId}/restaurants` - Get Restaurants Assigned to a User

Retrieve the list of restaurants assigned to a specific user. Brand users must have the CAN\_MANAGE\_BO\_USERS access flag, and the target user must belong to the same brand.

#### Parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| userId | integer | Yes | The ID of the user. |

#### Response

```json
{
  "status": 200,
  "code": "user_restaurants_succeed",
  "message": "You can access to those user restaurants.",
  "data": [
    {
      "restaurantId": 200,
      "name": "Innovorder Burgers Paris"
    },
    {
      "restaurantId": 201,
      "name": "Innovorder Burgers Lyon"
    }
  ]
}
```

##### Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| status | integer | 200 | HTTP status code returned by the API. |
| code | string | "user\_restaurants\_succeed" | Machine-readable application code for the result. |
| message | string | "You can access to those user restaurants." | Human-readable result message. Do not use this value for program logic. |
| data | array | \[…\] | Endpoint-specific response payload. |
| data\[\] | object | {…} | Endpoint-specific response payload. |
| data\[\].restaurantId | integer | 200 | Identifier of the restaurant. |
| data\[\].name | string | "Innovorder Burgers Paris" | The name value. |