Skip to main content
The Onboarding API is how a Sintropix Superadmin provisions new Users and controls which Organizations they can access. Public sign-up is disabled, so User creation happens only through this surface.
Superadmin only, from a signed-in browser session. A request that carries an API key or an OAuth access token receives 403 with SUPERADMIN_SESSION_REQUIRED, even when a Superadmin owns it. Any other signed-in User, including one with the staff Role in an Organization, receives 403 with SUPERADMIN_REQUIRED.
No API route makes a User a Superadmin. Being a Superadmin does not open any Entity’s books: a Superadmin reaches an Entity only through a Membership of its Organization.

​
POST /onboarding/users

Create a User. A User has no Role of their own: a new User reaches no Entity until you grant a Membership below, and the Role lives on that Membership. Body Response 201 An email another User already holds returns 409 with USER_ALREADY_EXISTS_ERROR.

​
GET /onboarding/users

List Users, look one up by email, or find the Users who haven’t signed in for a while. Use the email filter to recover a User’s id when all you hold is their address. Use inactiveForDays to find accounts nobody uses, for example before you revoke their Memberships. Query params Without filters, the response lists every User. With both filters, a User must match both. A value of inactiveForDays that is not a positive integer, such as 0, -3, or 1.5, returns 400. Response 200: an array of User objects in the shape returned by POST /onboarding/users (id, email, name, image, createdAt, lastSignInAt). An unknown email returns an empty array. lastSignInAt moves only when a sign-in completes, including its second factor when the User has one. A wrong password, a sign-in that stops at the second-factor code, and a session refresh leave it unchanged.
List the Users with no sign-in in the last 30 days:

​
GET /onboarding/organizations

List every Organization, each with the Entities it holds, whether or not you hold a Membership in it. Use it to pick the organizationId when you grant a Membership, create an Entity, or move an Entity. The response has the same shape as GET /organizations, which lists only the Organizations where the caller holds the staff Role.

​
GET /onboarding/users/:userId/memberships

List the Organization Memberships a User holds. Each Membership gives the User one Role across every Entity of that Organization. Response 200: an array of Memberships.

​
POST /onboarding/users/:userId/memberships

Grant a User a Membership in an Organization with one Role. The User reaches every Entity of the Organization, including Entities added to it later. A User holds at most one Membership per Organization. Body
  • Status: 204.

​
PATCH /onboarding/users/:userId/memberships/:organizationId

Change the Role of an existing Membership. Body
  • Status: 204.

​
DELETE /onboarding/users/:userId/memberships/:organizationId

Revoke a User’s Membership in an Organization. The User loses access to every Entity of the Organization on their next request. Every connected app the User approved for that Organization is revoked with it. No request body.
  • Status: 204.

​
POST /onboarding/users/:userId/set-password-link

Send the User a link they can follow to set (or reset) their password. Sintropix emails the link to the User, in their language, and answers it too, so you can also relay it over your own channel. No request body.
  • The link expires after 4 days and works once.
  • Each call sends a new link. Links sent earlier keep working until they’re used or expire.
  • If the email can’t be sent, the request fails and answers no link. Call it again.
  • The link carries the User’s email address, so the User types the password only once. Setting the password signs the User out of every session, then signs them in and continues to two-step verification: a User without it gets an emailed code to activate it, and a User with it is asked for their second factor.
  • A link that was already used or has expired shows Enlace no válido, with Pedir un enlace nuevo to ask for another one.
  • Users can also ask for a link themselves: ¿Olvidaste tu contraseña? on the sign-in page emails them a link. That link expires after 1 hour and also works once.
Response 201

​
POST /onboarding/users/:userId/revoke-sessions

Revoke every active session for a User, forcing a fresh sign-in on their next request. Use after a suspected credential compromise. No request body.
  • Status: 204.

​
DELETE /onboarding/users/:userId

Delete a User for good. The User loses access on their next request. No request body.
  • The deletion removes the User with everything that lets them in: their sessions, password, two-step verification, API keys, Organization Memberships, the connected apps they approved, and their pending set-password links.
  • The records the User wrote stay. The audit trail keeps the name and Role they had at each write and marks them deleted. A Payment Batch they created or marked Ready keeps its orders, with createdBy, createdByName, and readyBy set to null.
  • A request the User sent before the deletion that writes after it returns 401 and changes nothing.
  • The email is free again: you can create a new User with it, and that User starts with no Memberships.
  • You can’t delete yourself: deleting your own User returns 403 with USER_SELF_DELETION_ERROR, and params.userId names you.
  • An unknown User returns 404 with USER_NOT_FOUND_ERROR.
Response 200: the deleted User, in the shape returned by POST /onboarding/users (id, email, name, image, createdAt, lastSignInAt).

​
Status codes