Look up users by id, email, current session, or SSO provider id; create prospective users; activate or deactivate accounts; update profile fields under the first-sign-in rules; and opt users out of newsletters.

Use this page when you look up people, create prospective accounts, change active status, update profile fields, or opt someone out of newsletters through the public API. Shared base URL, authentication, status codes, and account rate limits stay in Using public Bevy APIs. Parameter and field details stay in Bevy API Reference.

Permissions you need

Without the permission, Bevy returns 403.

Look up a user

Email lookup uses a dedicated ceiling of 100 requests per hour per caller. An unknown SSO provider name returns 404. A known provider with an unknown uid returns 403.

Create a prospective user

A prospective user is someone who has not signed in for the first time. Create that account with:

POST /api/user/create_prospective_user/
Content-Type: application/json

{
  "email": "jordan.lee@example.com",
  "first_name": "Jordan",
  "last_name": "Lee",
  "send_welcome_emails": false
}

Require email, first_name, and last_name. Optional send_welcome_emails defaults to false. Communities that use organization SSO cannot create prospective users through this call — Bevy returns 403.

Create prospective user calls share a dedicated ceiling of 50 requests per hour (scope create_prospective), in addition to account-wide limits in Using public Bevy APIs.

When you can update a user

Use PATCH /api/user/{id}/ to replace only the fields you send. Update rules depend on who owns the field:

• Member-owned profile fields (for example name, city, title, and similar profile details) — the person themselves can update their own fields. Another authorized caller who patches those fields on someone else’s account receives 403, including when that person has never signed in.
• Admin-managed fields (for example role, and other fields reserved for organizers with Change user profile) — callers with accounts.change_userprofile can update those fields.

After someone signs in for the first time, treat member-owned profile updates as that person’s job through this API. To place someone on the community before first sign-in, use create_prospective_user rather than expecting PATCH to load their full profile for them. Full field lists stay in Bevy API Reference.

Activate and deactivate

Send exactly one of email or user_id — not both, and not neither:

POST /api/user/deactivate/
Content-Type: application/json

{
  "email": "jordan.lee@example.com"
}

POST /api/user/activate/
Content-Type: application/json

{
  "user_id": 1234
}

• Deactivate — the person can no longer sign in or act on the community. Deactivate calls share a dedicated ceiling of 100 requests per hour (scope user_deactivate).
• Activate — restores a previously deactivated account. Prospective users and accounts that are already active cannot be activated.

Both calls return 204 on success.

Opt out of newsletters

Opt a person out of all newsletter email lists with POST /api/user/mail/optout/. They still receive system and attendee-specific email. Pass user_id when you act for someone else (requires newsletters.change_contactlistuser); omit it to opt out the authenticated caller.

POST /api/user/mail/optout/
Content-Type: application/json

{
  "user_id": "1234"
}

This route’s only dedicated ceiling is 150 requests per minute (scope newsletter_optout). When you exceed a limit, Bevy returns 429 with a Retry-After header.