Users API

Manage user accounts, sessions, and activity

Overview

The Users API provides endpoints for managing user settings, activity logs, and sessions.

Get User Activity

GET /api/app/get_user_activity/v1

Fetch activity log entries for the current user with pagination.

Parameters

offset · number

Row offset for pagination (default: 0)

limit · number

Number of rows to return (default: 50)

Response

rows · array

Array of activity log entries

list · object

Pagination metadata

Example

cURL

curl -H "X-API-Key: YOUR_API_KEY" \
  "https://your-server.com/api/app/get_user_activity/v1?offset=0&limit=50"

Response

{
  "code": 0,
  "rows": [
    {
      "action": "user_login",
      "date": 1234567890,
      "ip": "192.168.1.100",
      "useragent": "Chrome 120.0 / macOS",
      "session_id": "abc123def456"
    }
  ],
  "list": { "length": 1 }
}

Update User Settings

POST /api/app/user_settings/v1

Update non-critical user settings for the current user.

Parameters

... · any

Any user settings to update (email, full_name, preferences, etc.)

Critical fields like password, active, privileges, and roles cannot be updated through this endpoint.

Example

cURL

curl -X POST \
  -H "Content-Type: application/json" \
  -H "X-Session-ID: YOUR_SESSION_ID" \
  -d '{
    "email": "[e-mail]",
    "full_name": "John Doe",
    "timezone": "America/New_York"
  }' \
  https://your-server.com/api/app/user_settings/v1

Response

{
  "code": 0,
  "user": {
    "username": "jdoe",
    "email": "[e-mail]",
    "full_name": "John Doe",
    "timezone": "America/New_York",
    "modified": 1234567890
  }
}

Logout All Sessions

POST /api/app/logout_all/v1

Logout all active sessions for the current user except the current session. This endpoint begins processing in the background.

Parameters

password · string · required

Current user password for verification

Example

cURL

curl -X POST \
  -H "Content-Type: application/json" \
  -H "X-Session-ID: YOUR_SESSION_ID" \
  -d '{"password": "your_password"}' \
  https://your-server.com/api/app/logout_all/v1

Response

{
  "code": 0
}

An email report is sent to the user after all sessions are logged out, detailing which sessions were terminated.

User Authentication

For user login and session management, xyOps uses session-based authentication. See the Authentication guide for details on:

• Creating sessions via login
• Using session tokens
• Session expiration
• API Key authentication (alternative to user sessions)

User Properties

Common user object properties:

Property	Type	Description
username	string	Unique username
email	string	Email address
full_name	string	Display name
active	boolean	Account status
created	number	Creation timestamp
modified	number	Last modified timestamp
privileges	object	User privileges
roles	array	Assigned role IDs
categories	array	Restricted categories (if any)
groups	array	Restricted server groups (if any)
timezone	string	User timezone

Activity Log Actions

Common activity log action types:

Action	Description
user_login	User logged in
user_logout	User logged out
user_create	User account created
user_update	User settings updated
password_change	Password changed
event_create	Event created
job_abort	Job aborted
ticket_create	Ticket created

Security Considerations

Always use HTTPS when transmitting session tokens or passwords. Session IDs should be treated as secrets.

Password Requirements

When changing passwords (via admin or user management UI):

• Minimum length requirements apply
• Password complexity rules may be enforced
• Old password verification required
• Password history may prevent reuse

Session Management

• Sessions expire after period of inactivity
• Maximum session lifetime enforced
• Sessions can be terminated remotely
• Failed login attempts are logged

User Management

Full user management (creating users, assigning privileges, managing roles) is typically done through:

1. Web UI - Admin users can manage all users
2. Admin API - Separate admin endpoints (requires admin privilege)
3. External Auth - LDAP/Active Directory integration

This Users API focuses on self-service operations. Administrative user management requires the admin privilege and uses separate endpoints.