users

Fields

Field	Type	Description
id	uuid	Unique identifier for the user (auto-generated)
displayName	String	User’s display name
email	String	User’s email address (unique, optional)
emailVerified	Boolean	Whether the email has been verified (defaults to false)
phoneNumber	String	User’s phone number (unique, optional)
phoneNumberVerified	Boolean	Whether the phone number has been verified (defaults to false)
avatarUrl	String	URL to the user’s avatar image
locale	String	User’s preferred locale
metadata	JSON	Additional user metadata (e.g., timezone, preferences)
newEmail	String	New email address pending verification (optional)
isAnonymous	Boolean	Whether this is an anonymous user (defaults to false)
disabled	Boolean	Whether the user account is disabled (defaults to false)
lastSeen	Timestamp	When the user was last active (optional)
createdAt	Timestamp	When the account was created (defaults to current timestamp)
updatedAt	Timestamp	When the account was last updated (defaults to current timestamp)

Authentication Fields

Field	Type	Description
passwordHash	String	Hashed password for password authentication (never exposed via API)
activeMfaType	String	Active multi-factor authentication method (optional)
totpSecret	String	Secret for time-based one-time password (optional)
otpHash	String	One-time password hash (never exposed via API)
otpHashExpiresAt	Timestamp	When the OTP hash expires
otpMethodLastUsed	String	Last used OTP method (optional)
ticket	String	Authentication ticket (optional)
ticketExpiresAt	Timestamp	When the authentication ticket expires
currentChallenge	String	Current authentication challenge (optional)

Relationships

Array Relationships

• apps — User’s connected applications (see user_app)
• members — Organization memberships
• roles — User’s assigned roles
• refreshTokens — Authentication refresh tokens
• securityKeys — WebAuthn security keys
• userProviders — Connected authentication providers (OAuth, etc.)

Query Examples

Get User Profile

query GetUserProfile($userId: uuid!) {
  user(id: $userId) {
    id
    displayName
    email
    emailVerified
    avatarUrl
    locale
    metadata
    newEmail
    lastSeen
    members {
      id
      org {
        name
      }
    }
  }
}

Mutation Examples

Update User Profile

mutation UpdateUserProfile {
  updateUser(
    pk_columns: { id: "user-id" }
    _set: {
      displayName: "New Name"
      locale: "en"
      metadata: { timezone: "Europe/Paris" }
    }
  ) {
    id
    displayName
    locale
    metadata
    updatedAt
  }
}

Permissions

Access to user data is strictly controlled:

• Users can only view and modify their own profile data
• Sensitive fields (passwordHash, otpHash, etc.) are never exposed via the API
• Role management is handled through dedicated endpoints
• Email and phone number changes require verification
• Account disabling can only be done by administrators