Admin API: users

The API offers the same actions as the Admin panel → Team («Админ-панель → Команда») section of the panel: managing users, their roles, passwords and permissions. The methods require a token with Full access («Полный доступ») (full). The exception is logging in as a user: it is not available with Api-Key. Authorization is described on the Admin API: overview and authorization page, and the response and error format on the Request, response and error format page.

User object

role values:

What each role can do is described on the Team and roles page.

Api-Key request specifics

• A request runs on behalf of the token creator — see Who the token acts as. “The current user” and “your own password” in the methods below mean the token creator.
• After a change to its own account, the panel gets code 200 and a new session. A request with Api-Key gets 204 with no body in the same cases.
• A token created by an admin does not change owner accounts: such requests return 403 — see Owner protection.
• Changing a user's login, role, team lead or password ends that user's open sessions in the panel. They need to log in again.

Team

List users

GET /api/v1/users

Returns all users of the team. No parameters.

Response — code 200 and an array of user objects in creation order.

curl https://panel.example.com/api/v1/users \
  -H "Api-Key: <token>"

[
  {
    "id": "3f2b8c1e-5a47-4d1b-9c0e-7a6d2f4b8e10",
    "workspace_id": "9a1d4c77-0b52-4e8f-a3c6-2d5e7f8a9b01",
    "email": "[email protected]",
    "role": "owner",
    "created_at": "2026-10-01T08:15:22.104518Z",
    "installation_owner": true
  },
  {
    "id": "c41a9e07-52bd-4f13-8a60-9d7e6f5a4b3c",
    "workspace_id": "9a1d4c77-0b52-4e8f-a3c6-2d5e7f8a9b01",
    "email": "buyer7",
    "role": "buyer",
    "manager_id": "7b0c1d52-3f4e-4a6b-9c8d-1e2f3a4b5c6d",
    "created_at": "2026-10-03T14:22:05.418332Z"
  }
]

Create a user

POST /api/v1/users

Creates an account with a login, a password and a role.

Response — code 201 and a user object without created_at.

curl -X POST https://panel.example.com/api/v1/users \
  -H "Api-Key: <token>" \
  -H "Content-Type: application/json" \
  -d '{"email": "buyer8", "password": "S3cure-pass", "role": "buyer", "manager_id": "7b0c1d52-3f4e-4a6b-9c8d-1e2f3a4b5c6d"}'

Update a user

PUT /api/v1/users/{id}

Changes the role, team lead and login. id in the path is the user ID.

Response — code 204 with no body. If the new role is below admin, this user's API tokens are deleted.

Set a user's password

POST /api/v1/users/{id}/password

Sets a new password for another user without knowing the old one. Your own password and the installation owner's password cannot be set with this method.

Response — code 204 with no body.

Delete a user

DELETE /api/v1/users/{id}

Deletes an account. The user's campaigns, offers, landing pages and shared funnels pass to their team lead, or to the token creator if there is no team lead. The deleted user's API tokens stop working.

Response — code 204 with no body.

Access restrictions

Restrictions are set for the teamlead, buyer, designer and viewer roles. How they work is described on the User permissions page.

Get a user's restrictions

GET /api/v1/users/{id}/access

Response — code 200 and a restrictions object:

Section keys: campaigns, automations, shared-funnels, offers, landers, reports, domains, traffic-sources.

Error: 404 not_found with the text resource not found if the user does not exist.

Save a user's restrictions

PUT /api/v1/users/{id}/access

Replaces the restrictions entirely. First read the current restrictions, change the fields you need and send the object back with the same revision.

Response — code 200 and the saved object with a new revision.

curl -X PUT https://panel.example.com/api/v1/users/c41a9e07-52bd-4f13-8a60-9d7e6f5a4b3c/access \
  -H "Api-Key: <token>" \
  -H "Content-Type: application/json" \
  -d '{"denied_sections": ["domains"], "read_only_sections": ["offers"], "campaign_groups": ["PL Nutra", ""], "hidden_fields": ["revenue", "cost"], "revision": 0}'

Logging in as a user and a team lead's team members

Log in as a user

POST /api/v1/users/{id}/impersonate

Issues a panel session on behalf of a team member. With Api-Key the method is not available with any scope, including full: the response is code 403.

{"code": "token_scope", "message": "API token scope does not allow this action"}

You can log in as a team member only from the panel, with the Log in as ↗ («Войти как ↗») button — see Log in as a user.

A team lead's team members

GET /api/v1/my-buyers

Returns the team members assigned to the current user, if that user is a team lead. For other roles the response is an empty array [] with code 200. A token works on behalf of an owner or an admin, so with Api-Key you get []. To get a team lead's team members, take the user list and select records by manager_id.

Token creator's profile

Get the time zone

GET /api/v1/profile/preferences

Response — code 200 and an object with a single timezone field: the personal time zone for new reports — see My profile: password and time zone.

Save the time zone

PUT /api/v1/profile/preferences

Response — code 200 and the saved object {"timezone": "Europe/Warsaw"}.

Errors: 400 Некорректный запрос (invalid request); 422 Некорректная IANA-таймзона (invalid IANA time zone).

Current user's effective restrictions

GET /api/v1/profile/access

Returns the same fields as the user's restrictions, plus the effective_hidden_fields array — the restricted fields together with dependent metrics. Owners and admins have no restrictions: the lists come as null, effective_hidden_fields is an empty array, revision is 0.

Change your own password

POST /api/v1/profile/password

Changes the token creator's password.

Response with Api-Key — code 204 with no body.

Errors: 400 invalid json; 422 новый пароль — минимум 8 символов (new password must be at least 8 characters); 422 текущий пароль неверен (current password is incorrect); 429 rate_limited with the text слишком много неверных попыток, попробуйте позже (too many failed attempts, try again later). A wrong current password counts as a failed login attempt: after 20 failures in 15 minutes for one login, the method returns 429 — see Login attempt limits.

Common errors

• 400 bad_request with the text некорректный идентификатор или значение (invalid ID or value) — manager_id in the body is not a UUID. See Identifiers.
• 404 not_found with the text пользователь не найден (user not found) — id in the path is not a UUID.
• 403 token_scope — the token's scope is not full, or this is a request to log in as a user. See Access types.
• 402 license_required — the license is inactive. See Expired license.
• Panel error texts with explanations are collected in the Error messages section.