Changelog
Back to All
Removed

Legacy user management API removed

4 months ago

The legacy public user-management routes have been removed in favor of account-scoped user and group management. This consolidates invitations, account roles, direct Data Product grants, and group-based access under account resources so clients no longer have to combine global user routes with Data Product-specific mutation routes.

Removed Endpoints

  • GET /api/v1/users
  • POST /api/v1/users
  • GET /api/v1/users/USERID
  • PATCH /api/v1/users/USERID
  • PATCH /api/v1/users
  • GET /api/v1/users/USERID/roles
  • POST /api/v1/users/USERID/roles
  • GET /api/v1/users/USERID/roles/{roleId}
  • PATCH /api/v1/users/USERID/roles/{roleId}
  • DELETE /api/v1/users/USERID/roles/{roleId}
  • PATCH /api/v1/accounts/{accountId}/data-products/{dataProductId}/users

Current Access APIs

  • Use GET /api/v1/accounts/{accountId}/users to list account users. Requires account Admin access.
  • Use POST /api/v1/accounts/{accountId}/users to invite users into an account. Requires account Admin access.
  • Use GET /api/v1/accounts/{accountId}/users/USERID to inspect a user's role, direct Data Product access, and group memberships. Requires account Admin access.
  • Use PATCH /api/v1/accounts/{accountId}/users/USERID to update account role, direct Data Product grants, or group memberships. Requires account Admin access.
  • Use GET /api/v1/accounts/{accountId}/user-groups and POST /api/v1/accounts/{accountId}/user-groups for group management. Requires account Admin access.
  • Use PATCH /api/v1/accounts/{accountId}/user-groups/{groupId} to update group members and Data Product grants. Requires account Admin access.
  • Use GET /api/v1/accounts/{accountId}/data-products/{dataProductId}/users to read direct users on a Data Product. Read-only; requires account Admin access.
  • Use GET /api/v1/accounts/{accountId}/data-products/{dataProductId}/groups to read groups granted to a Data Product. Read-only; requires account Admin access.

Migration Notes

Replace global user and role calls with account-scoped calls. Direct Data Product access is now a field on the account user mutation instead of a mutation on the Data Product users collection.

curl -s -X PATCH "${BOBSLED_BASE_URL}/api/v1/accounts/${ACCOUNT_ID}/users/$USER_ID" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "dataProducts": {
      "add": ["'"${DATA_PRODUCT_ID}"'"],
      "remove": []
    }
  }'

For team-based access, create or update a user group and patch its grants collection instead of applying the same direct grant to each user.