Users

All endpoints require authentication via the X-API-Key header. See Authentication.

List users

GET /users

Returns org users sorted by firstName, lastName ascending. The expoPushToken field is excluded from responses.

Query parameters

Parameter	Type	Default	Notes
`archived`	boolean \| `"all"`	`false`	`false` for active users, `true` for archived, `"all"` for both.

Example request

curl "https://<host>/api/users" \
  -H "X-API-Key: your-api-key"

Response

{
  "success": true,
  "data": [
    {
      "_id": "675a...",
      "firstName": "Jane",
      "lastName": "Smith",
      "email": "jane@example.com",
      "phone": "+15551234567",
      "profileImg": "https://storage.googleapis.com/...",
      "permissions": { "admin": true },
      "role": "admin",
      "stackedPhone": "+15559876543"
    }
  ]
}

Response envelope

All endpoints use the standard envelope:

{
  "error": false,
  "success": true,
  "message": "...",
  "code": 200,
  "data": "..."
}

Error responses:

{
  "error": true,
  "success": false,
  "message": "...",
  "code": 400,
  "data": null
}

data is null for a general failure, such as a database error or an upstream timeout. When the request is rejected because of a specific field, data carries the field(s) at fault instead:

{
  "error": true,
  "success": false,
  "message": "phone: Phone parse failed: The string supplied did not seem to be a phone number (input: <masked>)",
  "code": 400,
  "data": {
    "issues": [
      {
        "path": "phone",
        "message": "Phone parse failed: The string supplied did not seem to be a phone number (input: <masked>)"
      }
    ]
  }
}

Each issue carries a path (the dotted path into the request body) and a message. A label is added when the path is not self-describing, which today means custom fields only, for example "path": "fields.68b0a1f39c2e4d0012ab77e5", "label": "Class Year". issues is an array, but treat it as holding at most one entry: validation stops at the first failure.