Users and admin

Change a user's role

Promotes or demotes a WUTS user to a new role. The caller must have permission for the specific role transition; the response echoes the old and new roles.

POST
/users/{id}/promote

Promotes or demotes a WUTS user to a new role. The caller must have permission for the specific role transition; the response echoes the old and new roles.

Authorization

bearerAuth
AuthorizationBearer <token>

Per-user API token (UUID v4) sent as Authorization: Bearer <token>. Identifies the tenant and user.

In: header

Path Parameters

id*string

Identifier of the user whose role is being changed.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/users/string/promote" \  -H "Content-Type: application/json" \  -d '{    "new_role": "manager"  }'
{  "success": true,  "message": "User role updated successfully",  "data": {    "user_id": "7c2d1e3f-9a8b-4c10-b2d3-e4f5a6b7c8d9",    "old_role": "user",    "new_role": "manager"  }}
{  "success": false,  "error": "validation failed",  "error_code": "VALIDATION_ERROR",  "timestamp": "2026-06-15T12:00:00Z"}
{  "success": false,  "error": "validation failed",  "error_code": "VALIDATION_ERROR",  "timestamp": "2026-06-15T12:00:00Z"}
{  "success": false,  "error": "validation failed",  "error_code": "VALIDATION_ERROR",  "timestamp": "2026-06-15T12:00:00Z"}
{  "success": false,  "error": "validation failed",  "error_code": "VALIDATION_ERROR",  "timestamp": "2026-06-15T12:00:00Z"}
{  "success": false,  "error": "validation failed",  "error_code": "VALIDATION_ERROR",  "timestamp": "2026-06-15T12:00:00Z"}

List users (admin) GET

Lists all WUTS platform users within the admin's tenant. Requires the caller to hold the admin role; the tenant is resolved from the bearer token.

Delete a tenant permanently DELETE

Permanently removes a WUTS tenant and CASCADE-deletes all of its related data (users, devices, sessions and more). This is a destructive, irreversible master-token-only operation and is logged as a critical event.