Users

AM handles the complete user lifecycle—from registration to deprovisioning—including enterprise SCIM integration for automated provisioning.

Users belong to applications, have credentials for authentication, and can be members of multiple accounts with different roles.

User Lifecycle

Operations

Operation	Endpoint	Description
Create	`POST /api/applications/:application_id/users`	Provision user
List	`GET /api/applications/:application_id/users`	List application users
Get	`GET /api/users/:user_id`	Get user profile
Update	`PATCH /api/users/:user_id`	Modify user
Delete	`DELETE /api/users/:user_id`	Remove user

User Components

┌─────────────────────────────────────┐
│              User                   │
│  ┌─────────────┐  ┌─────────────┐  │
│  │  Identity   │  │ Credentials │  │
│  │  (PII)      │  │ (Auth)      │  │
│  └─────────────┘  └─────────────┘  │
│  ┌─────────────────────────────┐   │
│  │       Memberships           │   │
│  └─────────────────────────────┘   │
└─────────────────────────────────────┘

Component	Purpose
Identity	Name, avatar, locale—deletable for GDPR
Credentials	Email/password for authentication
Memberships	Links to accounts with roles

SCIM 2.0 Provisioning

Enterprise identity providers (Okta, Azure AD, OneLogin) can manage users via SCIM:

Endpoint	Method	Operation
`/scim/v2/Users`	GET	List/search users
`/scim/v2/Users`	POST	Create user
`/scim/v2/Users/:id`	GET	Get user
`/scim/v2/Users/:id`	PUT	Replace user
`/scim/v2/Users/:id`	PATCH	Update user
`/scim/v2/Users/:id`	DELETE	Disable user

SCIM delete performs soft-delete (sets status to disabled) to preserve audit trails.

Required scope: scim:provision or admin

User Status

Status	Description
`active`	Can authenticate and access resources
`suspended`	Temporarily blocked
`disabled`	SCIM deprovisioned
`deleted`	Permanently removed

User - User resource
User Identity - Profile data
Membership - Account relationships
Privacy - Data handling