User Profile and Admin Management Endpoints

This page documents the endpoints used to manage existing user accounts. Profile updates, authenticated password changes, role assignments, account deletion, and paginated user listing are all covered here. All endpoints that require authentication expect a valid JWT in the token-access request header (obtained from POST /api/user/login).

Update User Profile

`POST /api/user/update/:userId/user`

Updates a user’s personal profile fields. The caller must be authenticated with a valid token, and the userId in the path must match the authenticated user’s own ID. Only the fields listed below are accepted — email, roles, and activation status cannot be changed through this endpoint. Method: POST
Path: /api/user/update/:userId/user
Auth required: Yes (token-access header)

Path Parameters

userId

string

required

The unique ID of the user whose profile is being updated.

Request Body

firstName

string

required

The user’s updated first name.

lastName

string

required

The user’s updated last name.

phone

string

required

The user’s updated phone number.

sex

string

required

The user’s sex. Must be one of Masculino, Femenino, or Otro.

Response — 200 OK

msj

string

A human-readable confirmation message.

status

boolean

Always false on success.

updatedUser

object

The updated user document reflecting the new profile values.

Example Request

curl -X POST https://your-api-domain.com/api/user/update/64abc123/user \
  -H "Content-Type: application/json" \
  -H "token-access: <your-jwt-token>" \
  -d '{
    "firstName": "Carlos",
    "lastName": "Reyes",
    "phone": "3009876543",
    "sex": "Masculino"
  }'

Error Responses

Status Code	Meaning
`403`	The authenticated user’s ID does not match the `userId` path parameter, or the token is missing.
`404`	No user was found for the provided `userId`.

Update Password (Authenticated)

`POST /api/user/update-password-token/:userId`

Allows an authenticated user to change their own password. Unlike the recovery flow, this endpoint requires a valid JWT token and verifies the request against the account email. Both the new password and a confirmation must be provided. Method: POST
Path: /api/user/update-password-token/:userId
Auth required: Yes (token-access header)

Path Parameters

userId

string

required

The unique ID of the user changing their password.

Request Body

string

required

The email address associated with the account. Used to verify ownership.

newPassword

string

required

The new password to set. Will be stored as a bcrypt hash.

confirmNewPassword

string

required

Must match newPassword exactly. Used to prevent typos.

Response — 200 OK

Returns a success message confirming the password update.

Example Request

curl -X POST https://your-api-domain.com/api/user/update-password-token/64abc123 \
  -H "Content-Type: application/json" \
  -H "token-access: <your-jwt-token>" \
  -d '{
    "email": "carlos.reyes@example.com",
    "newPassword": "UpdatedPass789!",
    "confirmNewPassword": "UpdatedPass789!"
  }'

Error Responses

Status Code	Meaning
`403`	The token is missing, or the `userId` does not match the account, or the email does not match.
`404`	No user was found for the provided `userId`.

Update User Role

`POST /api/user/update/:userId/role/:adminId`

Assigns a new role to a target user. This action can only be performed by a user whose own roles include { name: "Admin", value: "2" }. The admin’s identity is validated server-side using adminId. Method: POST
Path: /api/user/update/:userId/role/:adminId
Auth required: Yes (token-access header)

This endpoint is admin-only. The adminId account must hold the Admin role (value: "2"). Requests from non-admin accounts will be rejected with a 203 response.

Path Parameters

userId

string

required

The unique ID of the user whose role is being updated.

adminId

string

required

The unique ID of the administrator performing the action. Used to verify admin privileges.

Request Body

roles

array

required

An array of role objects to assign to the target user. Each object must contain name and value fields.
Example: [{ "name": "Admin", "value": "2" }]

Response — 200 OK

msj

string

A human-readable confirmation message.

status

boolean

Always true on success.

updatedRole

object

The result of the update operation reflecting the new role assignment.

Example Request

curl -X POST https://your-api-domain.com/api/user/update/64abc123/role/99admin456 \
  -H "Content-Type: application/json" \
  -H "token-access: <your-jwt-token>" \
  -d '{
    "roles": [{ "name": "Admin", "value": "2" }]
  }'

Error Responses

Status Code	Meaning
`203`	The `adminId` account does not have the required Admin role.
`404`	No user was found for the provided `userId` or `adminId`.

Delete Account

`POST /api/user/account/:userId/delete`

Permanently deletes a user account by ID. This action is irreversible. A valid authentication token is required. Method: POST
Path: /api/user/account/:userId/delete
Auth required: Yes (token-access header)

Account deletion is permanent and cannot be undone. All data associated with the user ID will be removed from the database.

Path Parameters

userId

string

required

The unique ID of the user account to delete.

Response — 200 OK

Returns a success message confirming that the account has been deleted.

Example Request

curl -X POST https://your-api-domain.com/api/user/account/64abc123/delete \
  -H "token-access: <your-jwt-token>"

Error Responses

Status Code	Meaning
`203`	The account could not be found or the ID does not match.
`500`	An unexpected server error occurred.

List All Users (Admin)

`POST /api/user/getAll/:adminId/:pag?/:perpage?`

Returns a paginated list of all registered users. Only administrators (accounts with role { name: "Admin", value: "2" }) may call this endpoint. Pagination is controlled via URL path parameters and computed by the Paginate middleware before the handler runs. Method: POST
Path: /api/user/getAll/:adminId/:pag?/:perpage?
Auth required: No (admin identity is verified via adminId path parameter)

This route uses the Paginate middleware rather than the Token middleware. Access control is enforced by looking up the adminId in the database and confirming that account holds the Admin role. The pag and perpage path parameters are optional — if omitted, the Paginate middleware defaults perpage to 10 and starts from page 1.

Path Parameters

adminId

string

required

The unique ID of the administrator making the request. Used to verify admin privileges.

pag

number

The page number to retrieve. Optional — defaults to 1 if not provided.

perpage

number

The number of results to return per page. Optional — defaults to 10 if not provided.

Response — 200 OK

msj

string

A human-readable confirmation message.

status

boolean

Always false on success.

data

array

An array of user objects for the current page. Each object includes the following fields:

Show User object fields

firstName

string

The user’s first name.

lastName

string

The user’s last name.

string

The user’s email address.

phone

string

The user’s phone number.

sex

string

The user’s sex.

document

string

The user’s identification document number.

documentType

string

The user’s document type.

roles

array

The roles assigned to the user.

activate

array

The user’s activation status.

pagination

object

Metadata describing the current pagination state.

Show pagination fields

pag

number

The current page number (from the path parameter).

perpage

number

The number of results per page (from the Paginate middleware limit).

pags

number

The total number of pages available.

Example Request

curl -X POST https://your-api-domain.com/api/user/getAll/99admin456/1/10

Example Response

{
  "msj": "Cargando usuarios",
  "status": false,
  "data": [
    {
      "firstName": "Carlos",
      "lastName": "Reyes",
      "email": "carlos.reyes@example.com",
      "phone": "3001234567",
      "sex": "Masculino",
      "document": "1023456789",
      "documentType": "CC",
      "roles": [{ "name": "Usuario", "value": "1" }],
      "activate": [{ "name": "Activado", "value": "1" }]
    }
  ],
  "pagination": {
    "pag": "1",
    "perpage": 10,
    "pags": 5
  }
}

Error Responses

Status Code	Meaning
`203`	The `adminId` account does not have the required Admin role, or no matching admin was found.
`500`	An unexpected server error occurred.

Users

Products

Shopping Cart

User Profile and Admin Management Endpoints

Update User Profile

`POST /api/user/update/:userId/user`

Path Parameters

Request Body

Response — 200 OK

Example Request

Error Responses

Update Password (Authenticated)

`POST /api/user/update-password-token/:userId`

Path Parameters

Request Body

Response — 200 OK

Example Request

Error Responses

Update User Role

`POST /api/user/update/:userId/role/:adminId`

Path Parameters

Request Body

Response — 200 OK

Example Request

Error Responses

Delete Account

`POST /api/user/account/:userId/delete`

Path Parameters

Response — 200 OK

Example Request

Error Responses

List All Users (Admin)

`POST /api/user/getAll/:adminId/:pag?/:perpage?`

Path Parameters

Response — 200 OK

Example Request

Example Response

Error Responses

Build docs developers (and LLMs) love

Users

Products

Shopping Cart

Documentation Index

​Update User Profile

​POST /api/user/update/:userId/user

​Path Parameters

​Request Body

​Response — 200 OK

​Example Request

​Error Responses

​Update Password (Authenticated)

​POST /api/user/update-password-token/:userId

​Path Parameters

​Request Body

​Response — 200 OK

​Example Request

​Error Responses

​Update User Role

​POST /api/user/update/:userId/role/:adminId

​Path Parameters

​Request Body

​Response — 200 OK

​Example Request

​Error Responses

​Delete Account

​POST /api/user/account/:userId/delete

​Path Parameters

​Response — 200 OK

​Example Request

​Error Responses

​List All Users (Admin)

​POST /api/user/getAll/:adminId/:pag?/:perpage?

​Path Parameters

​Response — 200 OK

​Example Request

​Example Response

​Error Responses

Build docs developers (and LLMs) love

Update User Profile

`POST /api/user/update/:userId/user`

Path Parameters

Request Body

Response — 200 OK

Example Request

Error Responses

Update Password (Authenticated)

`POST /api/user/update-password-token/:userId`

Path Parameters

Request Body

Response — 200 OK

Example Request

Error Responses

Update User Role

`POST /api/user/update/:userId/role/:adminId`

Path Parameters

Request Body

Response — 200 OK

Example Request

Error Responses

Delete Account

`POST /api/user/account/:userId/delete`

Path Parameters

Response — 200 OK

Example Request

Error Responses

List All Users (Admin)

`POST /api/user/getAll/:adminId/:pag?/:perpage?`

Path Parameters

Response — 200 OK

Example Request

Example Response

Error Responses