The Users API provides full lifecycle management of restaurant staff accounts. Administrators can create, read, update, and permanently delete user records. Passwords are never stored in plain text — the controller hashes every password withDocumentation Index
Fetch the complete documentation index at: https://mintlify.com/FloresJesus/SS_RESTAURANT/llms.txt
Use this file to discover all available pages before exploring further.
bcryptjs at a cost factor of 10 before writing it to the usuario table, and the password_hash column is excluded from all query responses. Each user is assigned one of four roles (admin, cajero, mesero, cocina) that the role-guard middleware uses to restrict access across the entire API. Every write operation is recorded in the audit log. All endpoints require the admin role.
Endpoints
| Method | Path | Auth | Description |
|---|---|---|---|
GET | /api/users | admin | List all staff accounts |
GET | /api/users/:id | admin | Get a single user by ID |
POST | /api/users | admin | Create a new user account |
PUT | /api/users/:id | admin | Update an existing user account |
DELETE | /api/users/:id | admin | Permanently delete a user |
GET /api/users
Returns all user records ordered bycreado_en descending. Password hashes are never included.
GET /api/users/:id
Fetches a single user by their database ID. Returns404 if the user does not exist.
POST /api/users
Creates a new staff account. The email address must be unique across all users. The password is hashed before storage and is never returned in any response.Request body
User’s first name.
User’s last name / surname.
Unique email address used for login. Returns
400 if already registered.Plain-text password. The API hashes it with bcryptjs (cost 10) before storing it. Minimum length is not enforced server-side but a strong password is recommended.
Role assignment. Must be one of:
admin, cajero, mesero, cocina. Defaults to mesero if omitted.| Role | Access level |
|---|---|
admin | Full system access |
cajero | Payments, tickets, and invoices |
mesero | Orders and table management |
cocina | Kitchen order queue |
Whether the account is active. Defaults to
true. Inactive users (activo: false) cannot authenticate.201 Created:
Error responses
| Status | Condition |
|---|---|
400 | nombre, email, or password missing |
400 | rol is not one of the four valid values |
400 | Email is already registered to another account |
500 | Database or internal error |
PUT /api/users/:id
Updates the profile information of an existing user.nombre and email are required. If email is changed it must not conflict with another existing user’s address.
Request body
Updated first name.
Updated last name.
Updated email address. Must be unique; returns
400 if already in use by a different user.Updated role. Must be one of:
admin, cajero, mesero, cocina. If omitted, the existing role is preserved.Set to
false to disable the account without deleting it. Defaults to true.200 OK:
Error responses
| Status | Condition |
|---|---|
400 | nombre or email missing |
400 | rol is not one of the four valid values |
400 | email is already in use by a different user |
404 | User not found |
500 | Database or internal error |
DELETE /api/users/:id
Permanently removes the user record from the database. This operation cannot be undone.200 OK:
User response object
All GET endpoints return user records in this shape (password hash excluded):User primary key.
First name.
Last name.
Unique login email.
Role:
admin, cajero, mesero, or cocina.true if the account is enabled. Only active users can authenticate.ISO 8601 timestamp of account creation.
Inactive users (
activo: false) are excluded from role-based lookups used internally for assignment features (e.g., waiter assignment). They continue to appear in GET /api/users so administrators can re-enable them if needed.