Skip to Content
DevelopersAPI ReferenceUsers

Users & Access

User management is dashboard-only — it is not part of the public Client API. This is deliberate: user lifecycle operations (inviting users, changing roles, approving and blocking devices) are governed actions that require step-up MFA and produce audit events tied to a human administrator, which an API key cannot provide.

Manage users in the dashboard under Settings → Users:

  • Invite users and assign roles (Owner, Admin, Operator, Viewer) — see Roles & Permissions
  • Approve mobile signer devices and manage device certificates — see Device Management
  • Configure MFA and reset flows — see MFA

What the API sees of users

API keys are created by a user and inherit that profile’s context. User-related events are still visible to your integration via webhooks: USER_CREATED, USER_ROLE_UPDATED, USER_BLOCKED, USER_UNBLOCKED, USER_PASSWORD_RESET_INITIATED, DEVICE_CREATED, DEVICE_STATUS_CHANGED, DEVICE_REMOVED, and CERTIFICATE_READY.

PoliciesWebhooks