Reference

End users

An End User is a user of a customer's app, never a Sylphx member or principal.

Checked 2026-09-28

An End User is a user of a customer's app, never a Sylphx member or principal. (scope, email) is unique among live end users. Delete is revocation: it revokes every session and refuses new ones.

Service Sylphx Auth · Resource type auth.sylphx.com/EndUser · Name pattern orgs/{org}/projects/{project}/envs/{env}/end_users/{end_user} · Shape record

#Fields

Field	Type	What it is
name	string	orgs/{org}/projects/{project}/envs/{env}/end_users/{end_user}.
uid	string	usr_<cell><ulid>; never reused. Output only.
meta	ResourceMeta	Resource metadata.
email	string	The primary email address.
email_verify_time	timestamp	When email was verified. Output only.
password	string	An initial password; write-only, checked against breached passwords. Never returned again.
state	EndUserState	The lifecycle state. Output only. One of active, suspended.
factors	AuthMethod[]	Enrolled factors. Output only. One of password, magic_link, email_otp, passkey, totp, oidc, saml, device.
public_metadata	struct	App data readable by the end user's own tokens.
private_metadata	struct	App data readable only with an Access key.
last_login_time	timestamp	The last successful sign-in. Output only.
unsafe_metadata	struct	App data the end user may write with their own session (preferences a sign-up form collects); never trust it for authorization.
lock_expire_time	timestamp	Until when sign-in is locked after repeated failures; unset when not locked. Unlock clears it; a suspension is state, not a lock. Output only.
external_ids	map<string, string>	The customer's own ids for this end user, one per namespace (game_user, steam_id): how an app that signs users in by its own id finds them again. Read on create; never changed through here, because a set namespace's value is never rewritten — AttachEndUserExternalId sets an unset one. At most four namespaces. Never an authorization input: scope checks use grant ids.
synthetic_time	timestamp	When the end user became a test account: set once, when an end user who signed up with an address matching the Auth config's test_email_pattern first proved that address by a link or code. No update, import, address change or sign-in method ever sets it; changing the address clears it. Unset for every other end user. Output only.

#Methods

Every method of the collection, in the registry's order, with the scope it needs. The full request, response and examples are one link away.

Method	Call	What it does
GET	get	Gets an end user.
GET	list	Lists end users.
POST	create	Creates an end user.
PATCH	update	Updates an end user.
DELETE	delete	Deletes an end user.
POST	suspend	Suspends an end user: sessions are revoked and sign-in is refused.
POST	reactivate	Reactivates a suspended end user.
POST	unlock	Clears an end user's sign-in lock (repeated failed sign-ins) now.
POST	revoke_sessions	Revokes every session of an end user.
POST	attach_external_id	Sets the customer's own id for an end user, once: an unset namespace is written, a set one is never rewritten, and a different value for a set namespace is refused. A namespace holds one id for the life of the user. Erasure removes the ids and remembers their hashes, so a value that belonged to an erased user is never handed to another one.
GET	find	Finds the one end user of one of the customer's own ids. An id that belongs to no live user of this environment is RESOURCE_NOT_FOUND, the same answer a value erased with its user gives.

#get

Gets an end user.

GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user · scope auth:read · effect read · Request, response and examples

#list

Lists end users.

GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users · scope auth:read · effect read · paginated · Request, response and examples

#create

Creates an end user.

POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users · scope auth:write · effect write · Request, response and examples

#update

Updates an end user.

PATCH https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user · scope auth:write · effect write · Request, response and examples

#delete

Deletes an end user.

DELETE https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user · scope auth:write · effect destructive · Request, response and examples

#suspend

Suspends an end user: sessions are revoked and sign-in is refused.

POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user:suspend · scope auth:write · effect destructive · Request, response and examples

#reactivate

Reactivates a suspended end user.

POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user:reactivate · scope auth:write · effect write · Request, response and examples

#unlock

Clears an end user's sign-in lock (repeated failed sign-ins) now.

POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user:unlock · scope auth:write · effect write · Request, response and examples

#revoke_sessions

Revokes every session of an end user.

POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user:revokeSessions · scope auth:write · effect destructive · Request, response and examples

#attach_external_id

Sets the customer's own id for an end user, once: an unset namespace is written, a set one is never rewritten, and a different value for a set namespace is refused. A namespace holds one id for the life of the user. Erasure removes the ids and remembers their hashes, so a value that belonged to an erased user is never handed to another one.

POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user:attachExternalId · scope auth:write · effect write · Request, response and examples

#find

Finds the one end user of one of the customer's own ids. An id that belongs to no live user of this environment is RESOURCE_NOT_FOUND, the same answer a value erased with its user gives.

GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users:find · scope auth:read · effect read · Request, response and examples