Apps, Roles & Access
Resolve the active app context, list accessible apps, switch organization, and read roles, permissions, and user lookups.
Apps, Roles & Access
These endpoints expose the account context around the authenticated user: which app is currently resolved, which apps and organizations the user can reach, the roles and effective permissions granted, and directory-style lookups for finding other users.
All requests are authenticated with a Bearer JWT and require the X-App-Id header. Use the
X-Environment header to target the sandbox.
Current app context
GET /v1/users/app
Return the app context currently resolved for the session (from the X-App-Id header). Use
this to confirm which app a request will operate against.
No parameters. Uses the JWT and X-App-Id header.
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/users/appSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X GET 'https://cloud.vanitypass.com/v1/users/app' \ -H 'Content-Type: application/json' \ -H 'X-Environment: Sandbox' \
Accessible apps
GET /v1/users/apps
List the apps the authenticated user can access. Pair with X-App-Id to switch which app
subsequent requests target.
No parameters. Uses the JWT and X-App-Id header.
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/users/appsSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X GET 'https://cloud.vanitypass.com/v1/users/apps' \ -H 'Content-Type: application/json' \ -H 'X-Environment: Sandbox' \
Switch active organization
POST /v1/users/switch-org
Change the active organization for the session. Subsequent org-scoped requests resolve against the newly selected organization.
A request body is required and identifies the target organization; the spec does not constrain its shape further.
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/users/switch-orgSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X POST 'https://cloud.vanitypass.com/v1/users/switch-org' \
-H 'Content-Type: application/json' \
-H 'X-Environment: Sandbox' \
-d '{}'Roles
GET /v1/users/roles
Return the roles assigned to the authenticated user.
No parameters. Uses the JWT and X-App-Id header.
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/users/rolesSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X GET 'https://cloud.vanitypass.com/v1/users/roles' \ -H 'Content-Type: application/json' \ -H 'X-Environment: Sandbox' \
Effective permissions
GET /v1/users/permissions
Return the effective permissions for the authenticated user — the resolved set derived from their roles.
No parameters. Uses the JWT and X-App-Id header.
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/users/permissionsSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X GET 'https://cloud.vanitypass.com/v1/users/permissions' \ -H 'Content-Type: application/json' \ -H 'X-Environment: Sandbox' \
Search users
GET /v1/users/search
Search active users by username prefix within the authenticated user's current organization and application. The caller must have an active membership in that application.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
username | query | string | Yes | Username prefix containing 3–64 characters. |
Each result contains only:
| Field | Type | Description |
|---|---|---|
username | string | The user's username. |
image | string | null | Avatar image URL, if set. |
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/users/searchSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X GET 'https://cloud.vanitypass.com/v1/users/search' \ -H 'Content-Type: application/json' \ -H 'X-Environment: Sandbox' \
Search is limited to 30 requests per minute per user and application. A 429 response includes Retry-After.
Recently registered users
GET /v1/users/recent
Return the 100 most recently registered users. Each item is a full User record.
| Field | Type | Description |
|---|---|---|
id | string (uuid) | null | User identifier. |
username | string | Username. |
firstname | string | First name. |
lastname | string | Last name. |
email | string | Email address. |
phone_number | string | Phone number. |
gender | string | Gender. |
date_of_birth | string (date) | Date of birth. |
country | string | Country. |
country_code | string | Country dialing code. |
image | string | null | Avatar image URL. |
vibes | string[] | Interest tags. |
is_active | boolean | Whether the account is active. |
is_vendor | boolean | Whether the user is a vendor. |
is_sys_admin | boolean | Whether the user is a system admin. |
is_email_otp_verified | boolean | null | Email OTP verification state. |
vendor_name | string | null | Vendor display name, if a vendor. |
external_login_key | string | null | External login key. |
external_member_id | string | null | External member identifier. |
fmt_partner_id | string | null | Partner identifier. |
hash_encryption | string | null | Encrypted hash. |
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/users/recentSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X GET 'https://cloud.vanitypass.com/v1/users/recent' \ -H 'Content-Type: application/json' \ -H 'X-Environment: Sandbox' \