Integration authentication
Look up and update client-user records from an authorized integration.
The client-user routes expose directory operations for authorized existing integrations. They are separate from the Commercial API and do not define a public website registration flow.
Use one of these credentials:
ClientToken: <client-token> for an authorized backend integration.Authorization: Bearer <firebase-id-token> for a signed-in Firebase user.Client tokens must match the client ID in the path and the client API module must be enabled. Use the client token for backend directory operations. A Firebase ID token can access the signed-in user's own record where the route permits self-service; it does not grant directory administration.
GET /api/client/{clientId}/users
Example:
GET /api/client/your-client-id/users?email=user%40example.com
ClientToken: <client-token>Supported query parameters:
| Parameter | Meaning |
|---|---|
email | Exact email match. |
userType | player, cms, or silverCare. |
search | Case-insensitive search of displayName, email, and phoneNumber. |
attributeKey and attributeValue | Exact match in attributes; use the pair together. |
sortBy | createdAt, updatedAt, displayName, or email; default createdAt. |
sortDesc | true for descending order; default false. |
limit | Maximum results; default 50. |
offset | Number of results to skip; default 0. |
An exact email lookup returns one of these shapes:
{ "user": { "id": "<uid>", "email": "user@example.com" } }{ "user": null }A list or attribute lookup returns:
{
"users": [
{ "id": "<uid>", "email": "user@example.com" }
],
"pagination": {
"total": 1,
"limit": 50,
"offset": 0,
"hasMore": false
}
}The list response adds the Firestore document ID as id. Exact email lookup
returns user: null when there is no match.
GET /api/client/{clientId}/users/{userId}
GET /api/client/your-client-id/users/<uid>
Authorization: Bearer <firebase-id-token>Success:
{
"user": {
"uid": "<uid>",
"clientId": "your-client-id",
"email": "user@example.com",
"player": { "status": "active" }
}
}The route returns 404 when the record is absent, 401 for failed
authentication or an unauthorized user access, 400 for a missing path
parameter, and 500 for a server error.
PATCH /api/client/{clientId}/users/{userId}
Send a partial JSON object. Common integration fields include email,
displayName, photoURL, personalInfo, healthProfile, locale,
settings, and attributes. Nested personalInfo updates are also partial.
The released schema validates values and rejects unknown fields.
PATCH /api/client/your-client-id/users/<uid>
ClientToken: <client-token>
Content-Type: application/json{
"personalInfo": {
"firstName": "Example",
"lastName": "User"
},
"attributes": {
"membershipLevel": "standard"
}
}Do not update uid, clientId, createdAt, updatedAt, finance,
platform, or portal. Access and role fields require
administrative authorization. A Firebase ID token without that authorization
may update only self-service fields for its own UID.
Success:
{ "success": true }Errors are 400 for invalid or protected fields, 401 for failed or
insufficient authentication, 403 for a missing directory or management
permission, 404 when the user is absent, and 500 for a server error.
This page documents lookup, read, and update operations. It does not publish client-user creation steps, role-administration workflows, destructive deletion workflows, or a public registration API. Website registration remains a website operation.