Users API: Job Seeker Profile, Resume, and Uploads

The Users API manages everything related to job seeker accounts. Authenticated users can read and update their full profile — contact details, professional bio, skills, a structured work-history, and education entries. Two dedicated upload endpoints handle binary file storage: one for PDF résumés (stored under /uploads/resumes/) and one for profile pictures (stored under /uploads/profiles/). Résumé metadata (original filename, size in MB, upload timestamp) is persisted on the User record and snapshotted onto each Application at submission time. A single public endpoint lets anyone look up a user by UUID — useful for company-side applicant review flows.

All four profile endpoints (/profile, /resume, /profile-picture) require a USER role token. Sending a COMPANY token will return 403 Forbidden. Use GET /api/auth/me to fetch the company’s own profile instead.

User Object

string (UUID)

Unique user identifier.

name

string

Full name.

string

Registered email address (unique).

role

string

Always USER.

title

string

Professional headline (e.g. "Frontend Developer").

bio

string (text)

Short professional biography.

city

string

City of residence.

state

string

State or province.

country

string

Country.

zipCode

string

Postal / ZIP code.

location

string

Derived string "city, country" kept for backwards compatibility.

phone

string

Contact phone number.

portfolioUrl

string

Personal or portfolio website URL.

linkedinUrl

string

LinkedIn profile URL.

githubUrl

string

GitHub profile URL.

resumeUrl

string

Server-relative path to the uploaded résumé (e.g. /uploads/resumes/abc123.pdf).

resumeOriginalName

string

Original filename of the uploaded résumé.

resumeSize

string

File size formatted as a string (e.g. "1.42 MB").

resumeUploadDate

string (ISO 8601)

Timestamp of the most recent résumé upload.

profilePictureUrl

string

Server-relative path to the profile picture (e.g. /uploads/profiles/xyz789.jpg).

experienceLevel

string

Entry, Mid, Senior, Expert, or Lead.

skills

array of strings

JSON array of skill tags (e.g. ["React", "Node.js"]).

experience

array of objects

Show experience item fields

title

string

Job title held.

companyName

string

Employer name.

employmentType

string

e.g. "Full-time", "Contract".

startDate

string

Start date of the role.

endDate

string

End date (omit or null for current role).

location

string

Work location.

description

string

Role summary or responsibilities.

education

array of objects

JSON array of education entries.

createdAt

string (ISO 8601)

Account creation timestamp.

updatedAt

string (ISO 8601)

Last-updated timestamp.

Endpoints

GET /api/users/profile

Fetch the complete profile of the currently authenticated job seeker. The password field is excluded from the response. Auth: Required — Bearer token (USER role)

Request

No parameters. The user identity is resolved from the JWT.

Response

success

boolean

true on success.

data

object

Full User object (password excluded).

Example

curl https://api.example.com/api/users/profile \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

{
  "success": true,
  "data": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "name": "Jane Doe",
    "email": "jane@example.com",
    "role": "USER",
    "title": "Frontend Developer",
    "bio": "Passionate about building great UX.",
    "city": "Dhaka",
    "country": "Bangladesh",
    "location": "Dhaka, Bangladesh",
    "experienceLevel": "Mid",
    "skills": ["React", "TypeScript", "CSS"],
    "experience": [],
    "education": [],
    "resumeUrl": null,
    "profilePictureUrl": null,
    "createdAt": "2024-01-15T10:30:00.000Z",
    "updatedAt": "2024-06-01T08:00:00.000Z"
  }
}

PUT /api/users/profile

Update the authenticated user’s profile. Only the fields provided in the request body are changed; omitted fields retain their current values. When both city and country are provided, the computed location string is updated automatically. Auth: Required — Bearer token (USER role)

The experience array has server-side validation. Every item must include title, companyName, employmentType, startDate, location, and description. A 400 is returned if any item is missing a required field.

Request

name

string

Full name.

title

string

Professional headline.

bio

string

Short biography.

city

string

City of residence.

state

string

State or province.

country

string

Country.

zipCode

string

Postal / ZIP code.

phone

string

Contact phone number.

portfolioUrl

string

Portfolio website URL.

linkedinUrl

string

LinkedIn URL.

githubUrl

string

GitHub URL.

experienceLevel

string

Seniority level — Entry, Mid, Senior, Expert, or Lead.

skills

array of strings

Replaces the entire skills array.

experience

array of objects

Replaces the entire work-history array. Each item must include title, companyName, employmentType, startDate, location, and description.

education

array of objects

Replaces the entire education array.

Response

success

boolean

true on successful update.

data

object

Updated User object (password field stripped).

Example

curl -X PUT https://api.example.com/api/users/profile \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Senior Frontend Developer",
    "city": "Dhaka",
    "country": "Bangladesh",
    "experienceLevel": "Senior",
    "skills": ["React", "TypeScript", "Next.js", "GraphQL"],
    "experience": [
      {
        "title": "Frontend Developer",
        "companyName": "Acme Corp",
        "employmentType": "Full-time",
        "startDate": "2021-03-01",
        "endDate": "2024-01-01",
        "location": "Dhaka, Bangladesh",
        "description": "Built and maintained React-based dashboards."
      }
    ]
  }'

{
  "success": true,
  "data": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "name": "Jane Doe",
    "title": "Senior Frontend Developer",
    "city": "Dhaka",
    "country": "Bangladesh",
    "location": "Dhaka, Bangladesh",
    "experienceLevel": "Senior",
    "skills": ["React", "TypeScript", "Next.js", "GraphQL"],
    "updatedAt": "2024-07-01T09:00:00.000Z"
  }
}

POST /api/users/resume

Upload a résumé PDF. The request must use multipart/form-data encoding with the file attached under the field name resume. The server saves the file under /uploads/resumes/, records the original filename, converts the file size to a "X.XX MB" string, and stores the upload timestamp. A résumé must be uploaded before a user can submit any job application. Auth: Required — Bearer token (USER role)

Request

resume

file

required

The PDF résumé file. Use Content-Type: multipart/form-data. The multer middleware enforces the resume field name.

Response

success

boolean

true on successful upload.

data

object

Show data fields

resumeUrl

string

Server-relative path to the stored file (e.g. /uploads/resumes/1717689600000-resume.pdf).

resumeOriginalName

string

The original filename as provided by the client.

resumeSize

string

File size formatted as "X.XX MB".

resumeUploadDate

number

Unix timestamp (milliseconds) of the upload.

Example

curl -X POST https://api.example.com/api/users/resume \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -F "resume=@/path/to/jane-doe-resume.pdf"

{
  "success": true,
  "data": {
    "resumeUrl": "/uploads/resumes/1717689600000-jane-doe-resume.pdf",
    "resumeOriginalName": "jane-doe-resume.pdf",
    "resumeSize": "0.84 MB",
    "resumeUploadDate": 1717689600000
  }
}

If the user has not yet uploaded a résumé, attempting to apply for a job via POST /api/applications/jobs/:jobId/apply will return 400 Please upload a resume to your profile first.

POST /api/users/profile-picture

Upload a profile picture. Uses multipart/form-data with the file under the field name profilePicture. The image is stored under /uploads/profiles/. If the user already has a profile picture, the old file is deleted from disk before the new one is saved. Auth: Required — Bearer token (USER role)

Request

profilePicture

file

required

The image file (JPEG, PNG, etc.). Use Content-Type: multipart/form-data.

Response

success

boolean

true on successful upload.

message

string

"Profile picture uploaded successfully"

data

object

The updated User object (password excluded), including the new profilePictureUrl.

Example

curl -X POST https://api.example.com/api/users/profile-picture \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -F "profilePicture=@/path/to/avatar.jpg"

{
  "success": true,
  "message": "Profile picture uploaded successfully",
  "data": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "name": "Jane Doe",
    "email": "jane@example.com",
    "profilePictureUrl": "/uploads/profiles/1717689700000-avatar.jpg",
    "updatedAt": "2024-06-06T12:01:40.000Z"
  }
}

GET /api/users/:id

Retrieve any user’s public profile by their UUID. No authentication required. The password field is always excluded. This endpoint is used by companies to review applicant profiles. Auth: None

Request

string (UUID)

required

The UUID of the user to look up.

Response

success

boolean

true when the user is found.

data

object

Full User object with password excluded.

Example

curl https://api.example.com/api/users/a1b2c3d4-e5f6-7890-abcd-ef1234567890

{
  "success": true,
  "data": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "name": "Jane Doe",
    "title": "Senior Frontend Developer",
    "bio": "Passionate about building great UX.",
    "city": "Dhaka",
    "country": "Bangladesh",
    "experienceLevel": "Senior",
    "skills": ["React", "TypeScript", "Next.js"],
    "profilePictureUrl": "/uploads/profiles/1717689700000-avatar.jpg",
    "resumeUrl": "/uploads/resumes/1717689600000-jane-doe-resume.pdf"
  }
}

Error Reference

Status	Message	Cause
`400`	`Please upload a file`	Multipart request sent without a file attached
`400`	`Experience items must have companyName, …`	Experience array item is missing required fields
`401`	`Not authorized, no token`	Missing `Authorization` header
`403`	`User role COMPANY is not authorized…`	`COMPANY` token used on a `USER`-only route
`404`	`User not found`	No user found for the given ID or token

Authentication

Resources

Users API: Job Seeker Profile, Resume, and Uploads

User Object

Endpoints

GET /api/users/profile

Request

Response

Example

PUT /api/users/profile

Request

Response

Example

POST /api/users/resume

Request

Response

Example

POST /api/users/profile-picture

Request

Response

Example

GET /api/users/:id

Request

Response

Example

Error Reference

Build docs developers (and LLMs) love

Authentication

Resources

Documentation Index

​User Object

​Endpoints

​GET /api/users/profile

​Request

​Response

​Example

​PUT /api/users/profile

​Request

​Response

​Example

​POST /api/users/resume

​Request

​Response

​Example

​POST /api/users/profile-picture

​Request

​Response

​Example

​GET /api/users/:id

​Request

​Response

​Example

​Error Reference

Build docs developers (and LLMs) love

User Object

Endpoints

GET /api/users/profile

Request

Response

Example

PUT /api/users/profile

Request

Response

Example

POST /api/users/resume

Request

Response

Example

POST /api/users/profile-picture

Request

Response

Example

GET /api/users/:id

Request

Response

Example

Error Reference