<buttonid="sidebar-toggle"class="icon-button"type="button"title="Toggle Table of Contents"aria-label="Toggle Table of Contents"aria-controls="sidebar">
<ahref="https://github.com/matrix-org/synapse/edit/develop/docs/admin_api/user_admin_api.md"title="Suggest an edit"aria-label="Suggest an edit">
<iid="git-edit-button"class="fa fa-edit"></i>
</a>
</div>
</div>
<divid="search-wrapper"class="hidden">
<formid="searchbar-outer"class="searchbar-outer">
<inputtype="search"id="searchbar"name="searchbar"placeholder="Search this book ..."aria-controls="searchresults-outer"aria-describedby="searchresults-header">
If set to an empty string (<code>""</code>), the user's avatar is removed.</p>
</li>
<li>
<p><code>threepids</code> - <strong>array</strong>, optional. If provided, the user's third-party IDs (email, msisdn) are
entirely replaced with the given list. Each item in the array is an object with the following
fields:</p>
<ul>
<li><code>medium</code> - <strong>string</strong>, required. The type of third-party ID, either <code>email</code> or <code>msisdn</code> (phone number).</li>
<li><code>address</code> - <strong>string</strong>, required. The third-party ID itself, e.g. <code>alice@example.com</code> for <code>email</code> or
<code>447470274584</code> (for a phone number with country code "44") and <code>19254857364</code> (for a phone number
with country code "1") for <code>msisdn</code>.
Note: If a threepid is removed from a user via this option, Synapse will also attempt to remove
that threepid from any identity servers it is aware has a binding for it.</li>
</ul>
</li>
<li>
<p><code>external_ids</code> - <strong>array</strong>, optional. Allow setting the identifier of the external identity
provider for SSO (Single sign-on). More details are in the configuration manual under the
sections <ahref="../usage/configuration/config_documentation.html#sso">sso</a> and <ahref="../usage/configuration/config_documentation.html#oidc_providers">oidc_providers</a>.</p>
<ul>
<li><code>auth_provider</code> - <strong>string</strong>, required. The unique, internal ID of the external identity provider.
The same as <code>idp_id</code> from the homeserver configuration. Note that no error is raised if the
provided value is not in the homeserver configuration.</li>
<li><code>external_id</code> - <strong>string</strong>, required. An identifier for the user in the external identity provider.
When the user logs in to the identity provider, this must be the unique ID that they map to.</li>
</ul>
</li>
<li>
<p><code>admin</code> - <strong>bool</strong>, optional, defaults to <code>false</code>. Whether the user is a homeserver administrator,
granting them access to the Admin API, among other things.</p>
</li>
<li>
<p><code>deactivated</code> - <strong>bool</strong>, optional. If unspecified, deactivation state will be left unchanged.</p>
<p>Note: the <code>password</code> field must also be set if both of the following are true:</p>
<ul>
<li><code>deactivated</code> is set to <code>false</code> and the user was previously deactivated (you are reactivating this user)</li>
<li>Users are allowed to set their password on this homeserver (both <code>password_config.enabled</code> and
<code>password_config.localdb_enabled</code> config options are set to <code>true</code>).
Users' passwords are wiped upon account deactivation, hence the need to set a new one here.</li>
</ul>
<p>Note: a user cannot be erased with this API. For more details on
deactivating and erasing users see <ahref="#deactivate-account">Deactivate Account</a>.</p>
</li>
<li>
<p><code>locked</code> - <strong>bool</strong>, optional. If unspecified, locked state will be left unchanged.</p>
</li>
<li>
<p><code>user_type</code> - <strong>string</strong> or null, optional. If not provided, the user type will be
not be changed. If <code>null</code> is given, the user type will be cleared.
Other allowed options are: <code>bot</code> and <code>support</code>.</p>
<p>To paginate, check for <code>next_token</code> and if present, call the endpoint again
with <code>from</code> set to the value of <code>next_token</code>. This will return a new page.</p>
<p>If the endpoint does not return a <code>next_token</code> then there are no more users
to paginate through.</p>
<p><strong>Parameters</strong></p>
<p>The following parameters should be set in the URL:</p>
<ul>
<li>
<p><code>user_id</code> - Is optional and filters to only return users with user IDs
that contain this value. This parameter is ignored when using the <code>name</code> parameter.</p>
</li>
<li>
<p><code>name</code> - Is optional and filters to only return users with user ID localparts
<strong>or</strong> displaynames that contain this value.</p>
</li>
<li>
<p><code>guests</code> - string representing a bool - Is optional and if <code>false</code> will <strong>exclude</strong> guest users.
Defaults to <code>true</code> to include guest users. This parameter is not supported when MSC3861 is enabled. <ahref="https://github.com/matrix-org/synapse/pull/15582">See #15582</a></p>
</li>
<li>
<p><code>admins</code> - Optional flag to filter admins. If <code>true</code>, only admins are queried. If <code>false</code>, admins are excluded from
the query. When the flag is absent (the default), <strong>both</strong> admins and non-admins are included in the search results.</p>
</li>
<li>
<p><code>deactivated</code> - string representing a bool - Is optional and if <code>true</code> will <strong>include</strong> deactivated users.
Defaults to <code>false</code> to exclude deactivated users.</p>
</li>
<li>
<p><code>limit</code> - string representing a positive integer - Is optional but is used for pagination,
denoting the maximum number of items to return in this call. Defaults to <code>100</code>.</p>
</li>
<li>
<p><code>from</code> - string representing a positive integer - Is optional but used for pagination,
denoting the offset in the returned results. This should be treated as an opaque value and
not explicitly set to anything other than the return value of <code>next_token</code> from a previous call.
Defaults to <code>0</code>.</p>
</li>
<li>
<p><code>order_by</code> - The method by which to sort the returned list of users.
If the ordered field has duplicates, the second order is always by ascending <code>name</code>,
which guarantees a stable ordering. Valid values are:</p>
<ul>
<li><code>name</code> - Users are ordered alphabetically by <code>name</code>. This is the default.</li>
<li><code>is_guest</code> - Users are ordered by <code>is_guest</code> status.</li>
<li><code>admin</code> - Users are ordered by <code>admin</code> status.</li>
<li><code>user_type</code> - Users are ordered alphabetically by <code>user_type</code>.</li>
<li><code>deactivated</code> - Users are ordered by <code>deactivated</code> status.</li>
<li><code>shadow_banned</code> - Users are ordered by <code>shadow_banned</code> status.</li>
<li><code>displayname</code> - Users are ordered alphabetically by <code>displayname</code>.</li>
<li><code>avatar_url</code> - Users are ordered alphabetically by avatar URL.</li>
<li><code>creation_ts</code> - Users are ordered by when the users was created in ms.</li>
<li><code>last_seen_ts</code> - Users are ordered by when the user was lastly seen in ms.</li>
</ul>
</li>
<li>
<p><code>dir</code> - Direction of media order. Either <code>f</code> for forwards or <code>b</code> for backwards.
Setting this value to <code>b</code> will reverse the above sort order. Defaults to <code>f</code>.</p>
</li>
<li>
<p><code>not_user_type</code> - Exclude certain user types, such as bot users, from the request.
Can be provided multiple times. Possible values are <code>bot</code>, <code>support</code> or "empty string".
"empty string" here means to exclude users without a type.</p>
</li>
<li>
<p><code>locked</code> - string representing a bool - Is optional and if <code>true</code> will <strong>include</strong> locked users.
Defaults to <code>false</code> to exclude locked users. Note: Introduced in v1.93.</p>
</li>
</ul>
<p>Caution. The database only has indexes on the columns <code>name</code> and <code>creation_ts</code>.
This means that if a different sort order is used (<code>is_guest</code>, <code>admin</code>,
<code>user_type</code>, <code>deactivated</code>, <code>shadow_banned</code>, <code>avatar_url</code> or <code>displayname</code>),
this can cause a large load on the database, especially for large environments.</p>
<p><strong>Response</strong></p>
<p>The following fields are returned in the JSON response body:</p>
<ul>
<li>
<p><code>users</code> - An array of objects, each containing information about an user.
User objects contain the following fields:</p>
<ul>
<li><code>name</code> - string - Fully-qualified user ID (ex. <code>@user:server.com</code>).</li>
<li><code>is_guest</code> - bool - Status if that user is a guest account.</li>
<li><code>admin</code> - bool - Status if that user is a server administrator.</li>
<li><code>user_type</code> - string - Type of the user. Normal users are type <code>None</code>.
This allows user type specific behaviour. There are also types <code>support</code> and <code>bot</code>. </li>
<li><code>deactivated</code> - bool - Status if that user has been marked as deactivated.</li>
<li><code>erased</code> - bool - Status if that user has been marked as erased.</li>
<li><code>shadow_banned</code> - bool - Status if that user has been marked as shadow banned.</li>
<li><code>displayname</code> - string - The user's display name if they have set one.</li>
<li><code>avatar_url</code> - string - The user's avatar URL if they have set one.</li>
<li><code>creation_ts</code> - integer - The user's creation timestamp in ms.</li>
<li><code>last_seen_ts</code> - integer - The user's last activity timestamp in ms.</li>
<li><code>locked</code> - bool - Status if that user has been marked as locked. Note: Introduced in v1.93.</li>
</ul>
</li>
<li>
<p><code>next_token</code>: string representing a positive integer - Indication for pagination. See above.</p>
</li>
<li>
<p><code>total</code> - integer - Total number of media.</p>
</li>
</ul>
<p><em>Added in Synapse 1.93:</em> the <code>locked</code> query parameter and response field.</p>
<h2id="query-current-sessions-for-a-user"><aclass="header"href="#query-current-sessions-for-a-user">Query current sessions for a user</a></h2>
<p>This API returns information about the active sessions for a specific user.</p>
<p>The parameter <code>new_password</code> is required.
The parameter <code>logout_devices</code> is optional and defaults to <code>true</code>.</p>
<h2id="get-whether-a-user-is-a-server-administrator-or-not"><aclass="header"href="#get-whether-a-user-is-a-server-administrator-or-not">Get whether a user is a server administrator or not</a></h2>
<p><strong>Note:</strong> This API is disabled when MSC3861 is enabled. <ahref="https://github.com/matrix-org/synapse/pull/15582">See #15582</a></p>
<p>A response body like the following is returned:</p>
<pre><codeclass="language-json">{
"admin": true
}
</code></pre>
<h2id="change-whether-a-user-is-a-server-administrator-or-not"><aclass="header"href="#change-whether-a-user-is-a-server-administrator-or-not">Change whether a user is a server administrator or not</a></h2>
<p><strong>Note:</strong> This API is disabled when MSC3861 is enabled. <ahref="https://github.com/matrix-org/synapse/pull/15582">See #15582</a></p>
<p>The following parameters should be set in the URL:</p>
<ul>
<li><code>user_id</code> - fully qualified: for example, <code>@user:server.com</code>.</li>
</ul>
<p><strong>Response</strong></p>
<p>The following fields are returned in the JSON response body:</p>
<ul>
<li>
<p><code>pushers</code> - An array containing the current pushers for the user</p>
<ul>
<li>
<p><code>app_display_name</code> - string - A string that will allow the user to identify
what application owns this pusher.</p>
</li>
<li>
<p><code>app_id</code> - string - This is a reverse-DNS style identifier for the application.
Max length, 64 chars.</p>
</li>
<li>
<p><code>data</code> - A dictionary of information for the pusher implementation itself.</p>
<ul>
<li>
<p><code>url</code> - string - Required if <code>kind</code> is <code>http</code>. The URL to use to send
notifications to.</p>
</li>
<li>
<p><code>format</code> - string - The format to use when sending notifications to the
Push Gateway.</p>
</li>
</ul>
</li>
<li>
<p><code>device_display_name</code> - string - A string that will allow the user to identify
what device owns this pusher.</p>
</li>
<li>
<p><code>profile_tag</code> - string - This string determines which set of device specific rules
this pusher executes.</p>
</li>
<li>
<p><code>kind</code> - string - The kind of pusher. "http" is a pusher that sends HTTP pokes.</p>
</li>
<li>
<p><code>lang</code> - string - The preferred language for receiving notifications
(e.g. 'en' or 'en-US')</p>
</li>
<li>
<p><code>profile_tag</code> - string - This string determines which set of device specific rules
this pusher executes.</p>
</li>
<li>
<p><code>pushkey</code> - string - This is a unique identifier for this pusher.
Max length, 512 bytes.</p>
</li>
</ul>
</li>
<li>
<p><code>total</code> - integer - Number of pushers.</p>
</li>
</ul>
<p>See also the
<ahref="https://matrix.org/docs/spec/client_server/latest#get-matrix-client-r0-pushers">Client-Server API Spec on pushers</a>.</p>
<h2id="controlling-whether-a-user-is-shadow-banned"><aclass="header"href="#controlling-whether-a-user-is-shadow-banned">Controlling whether a user is shadow-banned</a></h2>
<p>Shadow-banning is a useful tool for moderating malicious or egregiously abusive users.
A shadow-banned users receives successful responses to their client-server API requests,
but the events are not propagated into rooms. This can be an effective tool as it
(hopefully) takes longer for the user to realise they are being moderated before
pivoting to another account.</p>
<p>Shadow-banning a user should be used as a tool of last resort and may lead to confusing
or broken behaviour for the client. A shadow-banned user will not receive any
notification and it is generally more appropriate to ban or kick abusive users.
A shadow-banned user will be unable to contact anyone on the server.</p>
<p>Checks to see if a username is available, and valid, for the server. See <ahref="https://matrix.org/docs/spec/client_server/r0.6.0#get-matrix-client-r0-register-available">the client-server
API</a>
for more information.</p>
<p>This endpoint will work even if registration is disabled on the server, unlike
<h2id="find-a-user-based-on-their-id-in-an-auth-provider"><aclass="header"href="#find-a-user-based-on-their-id-in-an-auth-provider">Find a user based on their ID in an auth provider</a></h2>
<p>The following parameters should be set in the URL:</p>
<ul>
<li><code>provider</code> - The ID of the authentication provider, as advertised by the <ahref="https://spec.matrix.org/latest/client-server-api/#post_matrixclientv3login"><code>GET /_matrix/client/v3/login</code></a> API in the <code>m.login.sso</code> authentication method.</li>
<li><code>external_id</code> - The user ID from the authentication provider. Usually corresponds to the <code>sub</code> claim for OIDC providers, or to the <code>uid</code> attestation for SAML2 providers.</li>
</ul>
<p>The <code>external_id</code> may have characters that are not URL-safe (typically <code>/</code>, <code>:</code> or <code>@</code>), so it is advised to URL-encode those parameters.</p>
<p><strong>Errors</strong></p>
<p>Returns a <code>404</code> HTTP status code if no user was found, with a response body like this:</p>
<pre><codeclass="language-json">{
"errcode":"M_NOT_FOUND",
"error":"User not found"
}
</code></pre>
<p><em>Added in Synapse 1.68.0.</em></p>
<h2id="find-a-user-based-on-their-third-party-id-threepid-or-3pid"><aclass="header"href="#find-a-user-based-on-their-third-party-id-threepid-or-3pid">Find a user based on their Third Party ID (ThreePID or 3PID)</a></h2>
