Users
Manage user accounts and their credential bundles.
Get the current user
Returns the authenticated user making the request. Allowed for every role. bundlePath is replaced with a presigned download link valid for up to 8 hours.
Get a user
Returns a user by numeric ID. Allowed for an admin or the user themselves. A non-empty bundlePath is replaced with a presigned download link valid for up to 8 hours.
Update a user
Updates a user. Only the fields present in the request body are changed; a field sent as null is treated as omitted. Allowed for an admin or the user themselves; only an admin may change userRole, active, commonName, or awsRoles (a non-admin may send them unchanged). Group memberships are updated when fullName, email, or userRole changes. Changing commonName or fullName does not issue a new certificate; use POST /tap/api/v1/users/{userId}/certificate. A non-empty bundlePath in the response is replaced with a presigned download link valid for up to 8 hours.
Delete a user
Deletes a user and removes their group memberships, certificate files, and certificate bundle. Requires the admin role.
Get a certificate bundle download link
Returns a presigned URL, valid for up to 8 hours, for downloading the user's certificate bundle. The link is generated without checking that the bundle exists. Allowed for an admin or the user themselves.
Rebuild a user certificate
Issues the user a new certificate with a new key pair and password, and rebuilds the certificate bundle. No email is sent. Requires the admin role.
Rebuild a user certificate bundle
Rebuilds and stores the user's certificate bundle from the user's existing certificate files. The certificate is not reissued. Requires the admin role.
Resend the certificate email
Resends the welcome email for the user's certificate bundle. Requires the admin role and email integration. The email is sent whether or not the sendWelcomeEmail setting is on; it includes a download link valid for up to 8 hours when the showBundleLinks setting is on, and attaches the bundle when the sendWelcomeEmailWithAttachment setting is on.
List users
Returns every user with all of its fields, sorted by fullName. Requires the admin role; a caller with the user role receives an empty list. Users with the super_admin role are included only for a super_admin caller. This version does not page, search, or filter, and ignores query parameters. bundlePath in each user is the stored location of the certificate bundle, not a download link. For summaries with paging and search, use GET /tap/api/v2/users.
Create a user
Creates a user, issues the user's certificate, and builds the certificate bundle. Requires the admin role. The default AWS roles are assigned when awsRoles is omitted or empty. When the sendWelcomeEmail setting is on and email integration is enabled, the user is sent a welcome email; it includes a download link valid for up to 8 hours when the showBundleLinks setting is on, and attaches the bundle when the sendWelcomeEmailWithAttachment setting is on. If the download link cannot be generated, the user is still created but no email is sent, and POST /tap/api/v1/users/{userId}/resend can send it later. bundlePath in the response is a presigned download link valid for up to 8 hours.
Get the current user (v2)
Returns the authenticated user making the request. Allowed for every role. bundlePath is the stored location of the certificate bundle, not a download link; use GET /tap/api/v2/users/{userId}/generateBundleUrl.
Get a user (v2)
Returns a user by numeric ID. Allowed for an admin or the user themselves. bundlePath is the stored location of the certificate bundle, not a download link; use GET /tap/api/v2/users/{userId}/generateBundleUrl.
Update a user (v2)
Updates a user. Only the fields present in the request body are changed; a field sent as null is treated as omitted. Allowed for an admin or the user themselves; only an admin may change userRole, active, commonName, or awsRoles (a non-admin may send them unchanged). Group memberships are updated when fullName, email, or userRole changes. Changing commonName or fullName does not issue a new certificate; use POST /tap/api/v2/users/{userId}/certificate. bundlePath in the response is the stored location of the certificate bundle, not a download link.
Delete a user (v2)
Deletes a user and removes their group memberships, certificate files, and certificate bundle. Requires the admin role.
Get a certificate bundle download link (v2)
Returns a presigned URL, valid for up to 8 hours, for downloading the user's certificate bundle. The link is generated without checking that the bundle exists. In v2 this is the only way to get a download link: bundlePath in a User is the stored location, not a link. Allowed for an admin or the user themselves.
Rebuild a user certificate (v2)
Issues the user a new certificate with a new key pair and password, and rebuilds the certificate bundle. No email is sent. Requires the admin role.
Rebuild a user certificate bundle (v2)
Rebuilds and stores the user's certificate bundle from the user's existing certificate files. The certificate is not reissued. Requires the admin role.
Resend the certificate email (v2)
Resends the welcome email for the user's certificate bundle. Requires the admin role and email integration. The email is sent whether or not the sendWelcomeEmail setting is on; it includes a download link valid for up to 8 hours when the showBundleLinks setting is on, and attaches the bundle when the sendWelcomeEmailWithAttachment setting is on.
List users (v2)
Returns a summary of each user. The complete user is available from GET /tap/api/v2/users/{userId}. Requires the admin role; a caller with the user role receives an empty list. Users with the super_admin role are included only for a super_admin caller. A single page is returned when pageSize, page, nextToken, or q is not blank, or when active or includeCounts is true; otherwise every user is returned, sorted by fullName. A page is sorted by fullName, ignoring case and surrounding whitespace, then by id.
Create a user (v2)
Creates a user, issues the user's certificate, and builds the certificate bundle. Requires the admin role. The default AWS roles are assigned when awsRoles is omitted or empty. When the sendWelcomeEmail setting is on and email integration is enabled, the user is sent a welcome email; it includes a download link valid for up to 8 hours when the showBundleLinks setting is on, and attaches the bundle when the sendWelcomeEmailWithAttachment setting is on. If the download link cannot be generated, the user is still created but no email is sent, and POST /tap/api/v2/users/{userId}/resend can send it later. bundlePath in the response is the stored location of the certificate bundle, not a download link.