Users API

Users, invitations and desktop app sign-ins. Service account tokens only. Every request sends a token in the Authorization: Bearer header; see Get started with the API.

List users

GET /api/admin/users

Lists users, newest first, admins included. Service accounts are not included. Returns up to limit users; for the next page, pass the created_at and id of the last user you received as cursor_ts and cursor_id. Under an API token, only users with one of the service account’s domains are listed.

Permission: Users: View (users:read)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`limit`	query	integer	How many users to return. A value outside 1 to 200 is ignored and the default used. Default `200`. Minimum 1. Maximum 200.
`cursor_ts`	query	string (date-time)	`created_at` of the last user on the previous page. Applies only together with `cursor_id`; an unreadable value is ignored and the first page returned.
`cursor_id`	query	string	`id` of the last user on the previous page. Applies only together with `cursor_ts`.

Response 200

The users.

data is array of AdminUser.

{
  "success": true,
  "data": [
    {
      "id": "3f2b8c1e-6a4d-4e2f-9b7a-1c5d8e9f0a12",
      "displayname": "Anna Berg",
      "email": "anna@example.com",
      "user_status": "active",
      "is_admin": false,
      "domain_ids": [
        "b1c2d3e4-5f60-4a7b-8c9d-0e1f2a3b4c5d"
      ],
      "auth_provider": "local",
      "is_break_glass": false,
      "created_at": "2026-09-14T08:32:11.402Z",
      "is_scim_connection": false,
      "is_sso_orphan": false,
      "avatar_url": "https://files.example.com/avatars/4c1d9a0e7b2f48a6b3e5d7c9f1a2b3c4"
    }
  ]
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Create a user

POST /api/admin/users

Creates an active user who signs in with the password you set. domain_ids puts the user on those domains’ access lists and group_ids adds them to Local groups; without either they can’t use the app until you put them on a domain’s access list with PUT /api/admin/domains/{id}/access/users/{userID} or add them to a group that has access. Under an API token, domain_ids is required and may list only the service account’s domains: a domain outside them is refused with 403. group_ids under an API token needs the groups:write permission too. Takes a seat on the license. API tokens can’t create admins: is_admin: true is refused with 403. A pending admin invitation for the same email is refused with 403 too, since the new user would replace it.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Request body

Content type application/json.

Field	Type	Description
`displayname` (required)	string	The user’s name.
`email` (required)	string (email)	Stored in lowercase. Must not belong to another user.
`password` (required)	string	Must meet the server’s password policy.
`is_admin`	boolean	Must be `false` under an API token. Default `false`.
`domain_ids`	array of string	Domains whose access list the user is put on, by ID from `GET /api/admin/domains`. Required under an API token, and only the service account’s domains.
`group_ids`	array of string	Local groups the user joins, by ID from `GET /api/admin/groups`. Under an API token, needs `groups:write`.

{
  "displayname": "Bob Lund",
  "email": "bob@example.com",
  "password": "Correct-Horse-42"
}

Response 200

The user was created.

data is CreatedUser.

{
  "success": true,
  "data": {
    "id": "8d4e2a7b-1f3c-4b9d-a6e5-2c7f9b0d3e45"
  },
  "message": "User created"
}

Errors

Status	When	Example message
400	The request is invalid.	“Invalid JSON” “All fields required” “Use at least 12 characters, with upper and lower case letters and a number.” “One of the groups in group_ids doesn’t exist or is managed in your identity provider.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, tried to create an admin or replace a pending admin invitation, the license has no seat left, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “This API token doesn’t have permission to add users to groups.” “API tokens can’t create or manage admins.” “User limit reached (25/25, including pending invites). Revoke unused invites or upgrade your license to add more users.” “Admin access is not allowed from this network.”
409	A user with this email already exists.	“A user with this email already exists. Enter a different email.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Delete a user

DELETE /api/admin/users/{id}

Deletes the user and everything they own: their shared links, their file requests and the files received through them are permanently deleted. To keep their files, transfer them first with POST /api/admin/users/{id}/transfer. Under an API token, admins can’t be managed: the request is refused with 403. Service accounts are not users here and answer 404. Under an API token, the user must have one of the service account’s domains; anyone else answers 404.

Permission: Users: Delete (users:delete)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The user’s ID.

Response 200

The user was deleted.

data is Success.

{
  "success": true,
  "message": "User deleted"
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the user is an admin, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “API tokens can’t create or manage admins.” “Admin access is not allowed from this network.”
404	No such user. Service accounts are not users here and also answer 404.	“User not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Transfer a user’s files and requests

POST /api/admin/users/{id}/transfer

Moves all of the user’s files and file requests, with the files received through them, to another active user. Their shared links keep working. Files people are still sending to those requests carry on; the user’s own unfinished uploads are canceled. Under an API token, admins can’t be managed: the request is refused with 403. Service accounts are not users here and answer 404. Under an API token, the user must have one of the service account’s domains; anyone else answers 404.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The user’s ID.

Request body

Content type application/json.

Field	Type	Description
`to_user_id` (required)	string	ID of the user who receives the files and file requests. Must be another active user.

{
  "to_user_id": "8d4e2a7b-1f3c-4b9d-a6e5-2c7f9b0d3e45"
}

Response 200

The files and requests were transferred.

data is Success.

{
  "success": true,
  "message": "Files and requests transferred"
}

Errors

Status	When	Example message
400	The request is invalid.	“Invalid JSON” “Choose another active user to receive the files and requests.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the user is an admin, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “API tokens can’t create or manage admins.” “Admin access is not allowed from this network.”
404	No such user. Service accounts are not users here and also answer 404.	“User not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Count what deleting a user removes

GET /api/admin/users/{id}/delete-impact

Counts the shared links, file requests and received files that deleting the user would permanently delete. Under an API token, admins can’t be managed: the request is refused with 403. Service accounts are not users here and answer 404. Under an API token, the user must have one of the service account’s domains; anyone else answers 404.

Permission: Users: View (users:read)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The user’s ID.

Response 200

The counts.

data is UserDeleteImpact.

{
  "success": true,
  "data": {
    "shared_links": 12,
    "file_requests": 3,
    "received_files": 41
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the user is an admin, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “API tokens can’t create or manage admins.” “Admin access is not allowed from this network.”
404	No such user. Service accounts are not users here and also answer 404.	“User not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Activate or deactivate a user

PUT /api/admin/users/{id}/status

Deactivating signs the user out everywhere, the desktop app included, and revokes their personal tokens; their files and requests stay. Activating takes a seat on the license. Users managed by SCIM, or whose email domain is no longer on their single sign-on connection, can’t be activated here. Asking for the status the user already has changes nothing. Under an API token, admins can’t be managed: the request is refused with 403. Service accounts are not users here and answer 404. Under an API token, the user must have one of the service account’s domains; anyone else answers 404.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The user’s ID.

Request body

Content type application/json.

Field	Type	Description
`user_status` (required)	string: `active`, `inactive`	Case-insensitive.

{
  "user_status": "inactive"
}

Response 200

The status was updated, or already was the one asked for (message is then User is already active or User is already inactive).

data is Success.

{
  "success": true,
  "message": "User status updated to inactive"
}

Errors

Status	When	Example message
400	The request is invalid.	“Invalid JSON” “User status must be ‘active’ or ‘inactive’”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the user is an admin, the license has no seat left, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “API tokens can’t create or manage admins.” “User limit reached (25/25, including pending invites). Revoke unused invites or upgrade your license to add more users.” “Admin access is not allowed from this network.”
404	No such user. Service accounts are not users here and also answer 404.	“User not found”
409	The user signs in with single sign-on and can’t be activated here.	“This user is managed by SCIM. Re-enable them in your identity provider, or convert to a local account.” “This user’s email domain is no longer on the SSO connection. Re-add the domain to the connection, or convert to a local account.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Email a user a password reset link

POST /api/admin/users/{id}/send-password-reset

Emails the user a link to set a new password. The link expires after 24 hours and is not returned to you. Only for active users who sign in with a password. Under an API token, admins can’t be managed: the request is refused with 403. Service accounts are not users here and answer 404. Under an API token, the user must have one of the service account’s domains; anyone else answers 404.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The user’s ID.

Response 200

The email was sent.

data is Success.

{
  "success": true,
  "message": "Password reset link sent"
}

Errors

Status	When	Example message
400	The user can’t get a reset link.	“Cannot send reset link to an inactive user” “Password reset is only available for local accounts”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the user is an admin, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “API tokens can’t create or manage admins.” “Admin access is not allowed from this network.”
404	No such user. Service accounts are not users here and also answer 404.	“User not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.
502	The email couldn’t be sent. Check the email settings.	“Failed to send password reset link”

Remove a user’s profile picture

DELETE /api/admin/users/{id}/avatar

Removes the user’s profile picture. Also succeeds when the user has none. Under an API token, admins can’t be managed: the request is refused with 403. Service accounts are not users here and answer 404. Under an API token, the user must have one of the service account’s domains; anyone else answers 404.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The user’s ID.

Response 200

The picture was removed, or there was none.

data is Success.

{
  "success": true,
  "message": "Profile picture removed"
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the user is an admin, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “API tokens can’t create or manage admins.” “Admin access is not allowed from this network.”
404	No such user. Service accounts are not users here and also answer 404.	“User not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Get a user’s access

GET /api/admin/users/{id}/access

Lists the groups the user is in, and every domain they have access to with how they got it: their own place on the domain’s access list, a group, or both. Service accounts are not users here and answer 404. Under an API token, the user must have one of the service account’s domains; anyone else answers 404. Admins can’t be managed under an API token: the request is refused with 403.

Permission: Users: View (users:read)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The user’s ID.

Response 200

The user’s groups and domains.

data is UserAccess.

{
  "success": true,
  "data": {
    "groups": [
      {
        "id": "everyone",
        "kind": "everyone",
        "name": "Everyone",
        "source": "everyone"
      },
      {
        "id": "7a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
        "kind": "local",
        "name": "Legal",
        "source": "added"
      }
    ],
    "domains": [
      {
        "domain_id": "b1c2d3e4-5f60-4a7b-8c9d-0e1f2a3b4c5d",
        "hostname": "files.example.com",
        "is_active": true,
        "routes": [
          {},
          {
            "group_id": "7a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
            "group_name": "Legal"
          }
        ]
      }
    ]
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the user is an admin, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “API tokens can’t create or manage admins.” “Admin access is not allowed from this network.”
404	No such user. Service accounts are not users here and also answer 404.	“User not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Invite a user

POST /api/admin/invites

Emails the person an invitation to create their account. The link expires after 3 days. A pending invitation takes a seat on the license. A new invitation to the same email closes the earlier one. API tokens can’t invite admins: is_admin: true is refused with 403. A pending admin invitation for the same email is refused with 403 too, since a new invitation would replace it. Under an API token, domain_ids is required and may list only the service account’s domains, and the new invitation closes earlier ones only where they give one of those domains. group_ids adds the person to Local groups when they accept; under an API token it needs the groups:write permission too.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Request body

Content type application/json.

Field	Type	Description
`email` (required)	string (email)	Who to invite. Must not belong to an existing user.
`domain_ids`	array of string	Domains the person gets access to when they accept. The invitation link uses the first active one, or the primary domain.
`source_domain_id`	string	The domain whose email settings and branding the invitation uses. Leave out to use the global settings.
`is_admin`	boolean	Must be `false` under an API token. Default `false`.
`group_ids`	array of string	Local groups the person joins when they accept, by ID from `GET /api/admin/groups`. Under an API token, needs `groups:write`.

{
  "email": "bob@example.com",
  "domain_ids": [
    "b1c2d3e4-5f60-4a7b-8c9d-0e1f2a3b4c5d"
  ]
}

Response 200

The invitation was sent.

data is Success.

{
  "success": true,
  "message": "Invite sent"
}

Errors

Status	When	Example message
400	The request is invalid.	“Invalid JSON” “Email is required” “Email is invalid” “User already exists” “One of the groups in group_ids doesn’t exist or is managed in your identity provider.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, tried to invite an admin or replace a pending admin invitation, the license has no seat left, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “This API token doesn’t have permission to add users to groups.” “API tokens can’t create or manage admins.” “User limit reached (25/25, including pending invites). Revoke unused invites or upgrade your license to add more users.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.
502	The invitation email couldn’t be sent. `ref` points your admin to the details in the system logs.	“Failed to send the invitation email”

List pending invitations

GET /api/admin/invites

Lists invitations not yet accepted or revoked, newest first, at most 500. Expired invitations stay listed for 7 days after they expire, so you can resend them. Under an API token, only invitations that give one of the service account’s domains are listed.

Permission: Users: View (users:read)
Service account tokens only, without Dew-Act-As.

Response 200

The invitations.

data is array of Invite.

{
  "success": true,
  "data": [
    {
      "id": "5e6f7a8b-9c0d-4e1f-8a2b-3c4d5e6f7a8b",
      "email": "bob@example.com",
      "domain_ids": [
        "b1c2d3e4-5f60-4a7b-8c9d-0e1f2a3b4c5d"
      ],
      "group_ids": [],
      "expires_at": "2026-10-07T09:15:00Z",
      "created_at": "2026-10-04T09:15:00Z",
      "expired": false
    }
  ]
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Revoke an invitation

POST /api/admin/invites/{id}/revoke

The invitation link stops working and its seat on the license is freed. API tokens can’t revoke an admin’s invitation: the request is refused with 403. Under an API token, the invitation must give one of the service account’s domains; any other answers 404.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The invitation’s ID.

Response 200

The invitation was revoked.

data is Success.

{
  "success": true,
  "message": "Invite revoked"
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the invitation is an admin’s, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “Admin access is not allowed from this network.”
404	No such invitation, or it was already accepted or revoked.	“Invite not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Resend an invitation

POST /api/admin/invites/{id}/resend

Emails a new invitation link that expires 3 days from now; the previous link stops working. Works for expired invitations too, which then take a seat on the license again. If the email can’t be sent, the previous link keeps working. API tokens can’t resend an admin’s invitation: the request is refused with 403. Under an API token, the invitation must give one of the service account’s domains; any other answers 404.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The invitation’s ID.

Response 200

The invitation was resent.

data is Success.

{
  "success": true,
  "message": "Invite resent"
}

Errors

Status	When	Example message
400	The invitation can’t be resent: it was used or revoked, or the person already has an account.	“Invite is no longer valid” “User already exists”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the invitation is an admin’s, the license has no seat left for an expired invitation, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “User limit reached (25/25, including pending invites). Revoke unused invites or upgrade your license to add more users.” “Admin access is not allowed from this network.”
404	No such invitation.	“Invite not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.
502	The invitation email couldn’t be sent. `ref` points your admin to the details in the system logs.	“Failed to send the invitation email”

List desktop app sign-ins

GET /api/admin/clients

Lists every computer signed in to the desktop app, for all users (under an API token, those of users with one of the service account’s domains), most recently signed in first, at most 1000.

Permission: Users: View (users:read)
Service account tokens only, without Dew-Act-As.

Response 200

The signed-in computers.

data is array of AdminClientDevice.

{
  "success": true,
  "data": [
    {
      "id": "9a8b7c6d-5e4f-4a3b-9c2d-1e0f9a8b7c6d",
      "user_id": "3f2b8c1e-6a4d-4e2f-9b7a-1c5d8e9f0a12",
      "user_email": "anna@example.com",
      "device_name": "ANNA-LAPTOP",
      "platform": "windows",
      "os_version": "Windows 11 23H2",
      "app_version": "1.4.0",
      "first_seen_at": "2026-08-02T07:41:09Z",
      "last_seen_at": "2026-10-03T13:05:22Z",
      "last_used_at": "2026-10-04T08:12:47Z",
      "last_ip": "203.0.113.24"
    }
  ]
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Sign out a desktop app

DELETE /api/admin/clients/{id}

Signs the desktop app out on that computer; it has to sign in again before it can be used. Under an API token, an admin’s computers can’t be signed out: the request is refused with 403. Under an API token, the computer’s user must have one of the service account’s domains; any other answers 404.

Permission: Users: Manage (users:write)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The device’s ID, from `GET /api/admin/clients`.

Response 200

The computer was signed out.

data is Success.

{
  "success": true,
  "message": "Device revoked"
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, the computer belongs to an admin, or the admin network allowlist refuses the caller.	“This API token doesn’t have permission for this action.” “API tokens can’t create or manage admins.” “Admin access is not allowed from this network.”
404	No such computer, or it’s already signed out.	“Device not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.