user_admin_api.md

User Admin API

To use it, you will need to authenticate by providing an access_token for a server admin: see Admin API.

Query User Account

This API returns information about a specific user account.

The api is:

GET /_synapse/admin/v2/users/<user_id>

It returns a JSON body like the following:

{
    "name": "@user:example.com",
    "displayname": "User", // can be null if not set
    "threepids": [
        {
            "medium": "email",
            "address": "<user_mail_1>",
            "added_at": 1586458409743,
            "validated_at": 1586458409743
        },
        {
            "medium": "email",
            "address": "<user_mail_2>",
            "added_at": 1586458409743,
            "validated_at": 1586458409743
        }
    ],
    "avatar_url": "<avatar_url>",  // can be null if not set
    "is_guest": 0,
    "admin": 0,
    "deactivated": 0,
    "shadow_banned": 0,
    "creation_ts": 1560432506,
    "appservice_id": null,
    "consent_server_notice_sent": null,
    "consent_version": null,
    "external_ids": [
        {
            "auth_provider": "<provider1>",
            "external_id": "<user_id_provider_1>"
        },
        {
            "auth_provider": "<provider2>",
            "external_id": "<user_id_provider_2>"
        }
    ],
    "user_type": null
}

URL parameters:

• user_id: fully-qualified user id: for example, @user:server.com.

Create or modify Account

This API allows an administrator to create or modify a user account with a specific user_id.

This api is:

PUT /_synapse/admin/v2/users/<user_id>

with a body of:

{
    "password": "user_password",
    "displayname": "User",
    "threepids": [
        {
            "medium": "email",
            "address": "<user_mail_1>"
        },
        {
            "medium": "email",
            "address": "<user_mail_2>"
        }
    ],
    "external_ids": [
        {
            "auth_provider": "<provider1>",
            "external_id": "<user_id_provider_1>"
        },
        {
            "auth_provider": "<provider2>",
            "external_id": "<user_id_provider_2>"
        }
    ],
    "avatar_url": "<avatar_url>",
    "admin": false,
    "deactivated": false,
    "user_type": null
}

Returns HTTP status code:

• 201 - When a new user object was created.
• 200 - When a user was modified.

URL parameters:

• user_id: fully-qualified user id: for example, @user:server.com.

Body parameters:

• password - string, optional. If provided, the user's password is updated and all devices are logged out.
• displayname - string, optional, defaults to the value of user_id.
• threepids - array, optional, allows setting the third-party IDs (email, msisdn)
  • medium - string. Kind of third-party ID, either email or msisdn.
  • address - string. Value of third-party ID. belonging to a user.
• external_ids - array, optional. Allow setting the identifier of the external identity provider for SSO (Single sign-on). Details in Sample Configuration File section sso and oidc_providers.
  • auth_provider - string. ID of the external identity provider. Value of idp_id in the homeserver configuration. Note that no error is raised if the provided value is not in the homeserver configuration.
  • external_id - string, user ID in the external identity provider.
• avatar_url - string, optional, must be a MXC URI.
• admin - bool, optional, defaults to false.
• deactivated - bool, optional. If unspecified, deactivation state will be left unchanged on existing accounts and set to false for new accounts. A user cannot be erased by deactivating with this API. For details on deactivating users see Deactivate Account.
• user_type - string or null, optional. If provided, the user type will be adjusted. If null given, the user type will be cleared. Other allowed options are: bot and support.

If the user already exists then optional parameters default to the current value.

In order to re-activate an account deactivated must be set to false. If users do not login via single-sign-on, a new password must be provided.

List Accounts

This API returns all local user accounts. By default, the response is ordered by ascending user ID.

GET /_synapse/admin/v2/users?from=0&limit=10&guests=false

A response body like the following is returned:

{
    "users": [
        {
            "name": "<user_id1>",
            "is_guest": 0,
            "admin": 0,
            "user_type": null,
            "deactivated": 0,
            "shadow_banned": 0,
            "displayname": "<User One>",
            "avatar_url": null,
            "creation_ts": 1560432668000
        }, {
            "name": "<user_id2>",
            "is_guest": 0,
            "admin": 1,
            "user_type": null,
            "deactivated": 0,
            "shadow_banned": 0,
            "displayname": "<User Two>",
            "avatar_url": "<avatar_url>",
            "creation_ts": 1561550621000
        }
    ],
    "next_token": "100",
    "total": 200
}

To paginate, check for next_token and if present, call the endpoint again with from set to the value of next_token. This will return a new page.

If the endpoint does not return a next_token then there are no more users to paginate through.

Parameters

The following parameters should be set in the URL:

• user_id - Is optional and filters to only return users with user IDs that contain this value. This parameter is ignored when using the name parameter.

• name - Is optional and filters to only return users with user ID localparts or displaynames that contain this value.

• guests - string representing a bool - Is optional and if false will exclude guest users. Defaults to true to include guest users.

• deactivated - string representing a bool - Is optional and if true will include deactivated users. Defaults to false to exclude deactivated users.

• limit - string representing a positive integer - Is optional but is used for pagination, denoting the maximum number of items to return in this call. Defaults to 100.

• from - string representing a positive integer - Is optional but used for pagination, denoting the offset in the returned results. This should be treated as an opaque value and not explicitly set to anything other than the return value of next_token from a previous call. Defaults to 0.

• order_by - The method by which to sort the returned list of users. If the ordered field has duplicates, the second order is always by ascending name, which guarantees a stable ordering. Valid values are:

  • name - Users are ordered alphabetically by name. This is the default.
  • is_guest - Users are ordered by is_guest status.
  • admin - Users are ordered by admin status.
  • user_type - Users are ordered alphabetically by user_type.
  • deactivated - Users are ordered by deactivated status.
  • shadow_banned - Users are ordered by shadow_banned status.
  • displayname - Users are ordered alphabetically by displayname.
  • avatar_url - Users are ordered alphabetically by avatar URL.
  • creation_ts - Users are ordered by when the users was created in ms.

• dir - Direction of media order. Either f for forwards or b for backwards. Setting this value to b will reverse the above sort order. Defaults to f.

Caution. The database only has indexes on the columns name and creation_ts. This means that if a different sort order is used (is_guest, admin, user_type, deactivated, shadow_banned, avatar_url or displayname), this can cause a large load on the database, especially for large environments.

Response

The following fields are returned in the JSON response body:

• users - An array of objects, each containing information about an user. User objects contain the following fields:

  • name - string - Fully-qualified user ID (ex. @user:server.com).
  • is_guest - bool - Status if that user is a guest account.
  • admin - bool - Status if that user is a server administrator.
  • user_type - string - Type of the user. Normal users are type None. This allows user type specific behaviour. There are also types support and bot.
  • deactivated - bool - Status if that user has been marked as deactivated.
  • shadow_banned - bool - Status if that user has been marked as shadow banned.
  • displayname - string - The user's display name if they have set one.
  • avatar_url - string - The user's avatar URL if they have set one.
  • creation_ts - integer - The user's creation timestamp in ms.

• next_token: string representing a positive integer - Indication for pagination. See above.

• total - integer - Total number of media.

Query current sessions for a user

This API returns information about the active sessions for a specific user.

The endpoints are:

GET /_synapse/admin/v1/whois/<user_id>

and:

GET /_matrix/client/r0/admin/whois/<userId>

See also: Client Server API Whois.

It returns a JSON body like the following:

{
    "user_id": "<user_id>",
    "devices": {
        "": {
            "sessions": [
                {
                    "connections": [
                        {
                            "ip": "1.2.3.4",
                            "last_seen": 1417222374433,
                            "user_agent": "Mozilla/5.0 ..."
                        },
                        {
                            "ip": "1.2.3.10",
                            "last_seen": 1417222374500,
                            "user_agent": "Dalvik/2.1.0 ..."
                        }
                    ]
                }
            ]
        }
    }
}

last_seen is measured in milliseconds since the Unix epoch.

Deactivate Account

This API deactivates an account. It removes active access tokens, resets the password, and deletes third-party IDs (to prevent the user requesting a password reset).

It can also mark the user as GDPR-erased. This means messages sent by the user will still be visible by anyone that was in the room when these messages were sent, but hidden from users joining the room afterwards.

The api is:

POST /_synapse/admin/v1/deactivate/<user_id>

with a body of:

{
    "erase": true
}

The erase parameter is optional and defaults to false. An empty body may be passed for backwards compatibility.

The following actions are performed when deactivating an user:

• Try to unbind 3PIDs from the identity server
• Remove all 3PIDs from the homeserver
• Delete all devices and E2EE keys
• Delete all access tokens
• Delete all pushers
• Delete the password hash
• Removal from all rooms the user is a member of
• Remove the user from the user directory
• Reject all pending invites
• Remove all account validity information related to the user
• Remove the arbitrary data store known as account data. For example, this includes:
  • list of ignored users;
  • push rules;
  • secret storage keys; and
  • cross-signing keys.

The following additional actions are performed during deactivation if erase is set to true:

• Remove the user's display name
• Remove the user's avatar URL
• Mark the user as erased

The following actions are NOT performed. The list may be incomplete.

• Remove mappings of SSO IDs
• Delete media uploaded by user (included avatar images)
• Delete sent and received messages
• Remove the user's creation (registration) timestamp
• Remove rate limit overrides
• Remove from monthly active users

Reset password

Changes the password of another user. This will automatically log the user out of all their devices.

The api is:

POST /_synapse/admin/v1/reset_password/<user_id>

with a body of:

{
   "new_password": "<secret>",
   "logout_devices": true
}

The parameter new_password is required. The parameter logout_devices is optional and defaults to true.

Get whether a user is a server administrator or not

The api is:

GET /_synapse/admin/v1/users/<user_id>/admin

A response body like the following is returned:

{
    "admin": true
}

Change whether a user is a server administrator or not

Note that you cannot demote yourself.

The api is:

PUT /_synapse/admin/v1/users/<user_id>/admin

with a body of:

{
    "admin": true
}