Authenticated User

The /api/v1/user/* endpoints operate on the currently authenticated user identified by the request token. All paths on this page are relative to the API root /api/v1 (for example, /user/emails is https://<akp-host>/api/v1/user/emails).

Unless noted otherwise:

• Auth: Token — send Authorization: token <YOUR_TOKEN>.

A few endpoints require additional privileges (site admin) or are only registered on AppsCode-hosted deployments; this is called out per endpoint.

Current user & session

GET /user

Get the authenticated user.

• Auth: Token.

Query parameters:

Response: 200 OK — a User object.

{
  "id": 2,
  "login": "someuser",
  "username": "someuser",
  "full_name": "Some User",
  "email": "user@example.com",
  "avatar_url": "https://secure.gravatar.com/avatar/<hash>?d=identicon",
  "language": "en-US",
  "is_admin": true,
  "last_login": "2026-07-13T18:23:53Z",
  "created": "2026-07-05T06:46:29Z",
  "type": 0,
  "active": true,
  "prohibit_login": false,
  "orgAdmin": false,
  "clientOrgUser": false
}

The User fields are documented in the Public & Basic-auth User APIs page.

Verified: GET /user returned 200 against appscode on 2026-07-14.

Example:

curl -H "Authorization: token $AKP_TOKEN" \
  https://<akp-host>/api/v1/user

GET /user/signout

Sign out the authenticated user (clears session and auth cookies).

• Auth: Token.

Response: 200 OK with no body.

GET /user/login-method

Report how a user or organization should sign in — password, or redirect to the organization’s SSO provider. Called by the sign-in UI before the password field is shown, so it takes no token.

• Auth: Public (no authentication).

Query parameters: at least one of the two is required.

Response: 200 OK (LoginMethodResponse). With no SSO source in play:

{ "method": "password" }

When SSO applies, the remaining fields are set:

{
  "method": "sso",
  "orgAuthSourceID": 7,
  "providerName": "openidConnect",
  "oauthCallbackPath": "/user/oauth2/org-3",
  "displayName": "Acme SSO"
}

Errors: 400 when neither orgname nor username is supplied.

The auth source itself is managed through the organization auth-source endpoints.

GET /user/firebase-token

Get a Firebase custom auth token for the authenticated user. Only registered on AppsCode-hosted deployments.

• Auth: Token. AppsCode-hosted deployments only.

Response: 200 OK — a FirebaseToken.

{
  "firebaseToken": "<firebase-custom-token>"
}

Verified: GET /user/firebase-token returned 404 against appscode on 2026-07-14 — the route is not registered on this (self-hosted) deployment.

NATS credentials

GET /user/nats/credentials

Get the authenticated user’s NATS credentials (endpoints plus credential bytes for the primary NATS user).

• Auth: Token.

Response: 200 OK — a NatsCredentialsResponse.

{
  "natsEndpoints": ["nats://nats.example.com:4222"],
  "credentials": "<base64-encoded-creds>"
}

Verified: GET /user/nats/credentials returned 200 against appscode on 2026-07-14. (Credential bytes redacted above.)

GET /user/nats/admin_credentials

Get NATS admin credentials. The response body is deployment-specific and modeled as an opaque JSON object.

• Auth: Token + site admin.

Response: 200 OK — an opaque object.

Verified: GET /user/nats/admin_credentials returned 200 against appscode on 2026-07-14 (called with a site-admin token).

GET /user/nats/user_credentials

Get NATS user credentials. Deployment-specific opaque object.

• Auth: Token + site admin.

Response: 200 OK — an opaque object.

Verified: GET /user/nats/user_credentials returned 302 against appscode on 2026-07-14 — the request was redirected (missing required NATS user context on this deployment).

GET /user/nats/cluster-resource-history

Get cluster resource history from NATS. Deployment-specific opaque object.

• Auth: Token + site admin.

Response: 200 OK — an opaque object.

Verified: GET /user/nats/cluster-resource-history returned 400 against appscode on 2026-07-14 — required query parameters (cluster context) were not supplied.

Emails

GET /user/emails

List the authenticated user’s email addresses.

• Auth: Token.

Response: 200 OK — an array of Email objects.

[
  { "email": "user@example.com", "verified": true, "primary": true }
]

Verified: GET /user/emails returned 200 against appscode on 2026-07-14.

POST /user/emails

Add one or more email addresses.

• Auth: Token.

Request body: CreateEmailOption.

{
  "emails": ["user@example.com"]
}

Response: 201 Created — the updated array of Email objects.

DELETE /user/emails

Delete one or more email addresses.

• Auth: Token.

Request body: DeleteEmailOption.

{
  "emails": ["user@example.com"]
}

Response: 204 No Content.

Social follow

GET /user/followers

List the authenticated user’s followers.

• Auth: Token.

Query parameters:

Response: 200 OK — an array of User objects.

Verified: GET /user/followers returned 200 against appscode on 2026-07-14.

GET /user/following

List the users the authenticated user is following.

• Auth: Token.

Query parameters:

Response: 200 OK — an array of User objects.

Verified: GET /user/following returned 200 against appscode on 2026-07-14.

GET /user/following/{username}

Check whether the authenticated user follows the given user.

• Auth: Token.

Path parameters:

Response: 204 No Content if following; 404 otherwise.

PUT /user/following/{username}

Follow a user.

• Auth: Token.

Path parameters:

Response: 204 No Content.

DELETE /user/following/{username}

Unfollow a user.

• Auth: Token.

Path parameters:

Response: 204 No Content.

Organizations & teams

GET /user/teams

List all teams the authenticated user belongs to.

• Auth: Token.

Response: 200 OK — an array of Team objects.

[
  {
    "id": 5,
    "name": "developers",
    "description": "Application developers",
    "permission": "write",
    "type": "",
    "units": [],
    "role_ids": []
  }
]

Verified: GET /user/teams returned 200 against appscode on 2026-07-14.

GET /user/orgs

List the organizations the authenticated user belongs to, including private memberships.

• Auth: Token.

Response: 200 OK — an array of Organization objects (same shape as GET /orgs/{orgname}).

For another user’s public memberships, use GET /users/{username}/orgs.

Organization list endpoints for the authenticated user live under settings — see GET /user/settings/organizations.

Clusters

GET /user/clusters

List clusters the authenticated user owns or can access.

• Auth: Token.

Query parameters:

Response: 200 OK — an array of ClusterInfo objects.

[
  {
    "id": 1,
    "displayName": "KubeDB Platform Hub",
    "name": "ace",
    "uid": "<uid>",
    "ownerName": "appscode",
    "provider": "generic",
    "kubernetesVersion": "1.29.0",
    "nodeCount": 3,
    "createdAt": "2026-07-05T06:46:29Z"
  }
]

Key ClusterInfo fields: id, displayName, name, uid, ownerID/ownerName, provider, vendor, kubernetesVersion, nodeCount, endpoint, location, hubClusterName, clusterSetName, isMonitoringCluster, createdAt, age, and a status (a Kubernetes-style object).

Verified: GET /user/clusters returned 200 against appscode on 2026-07-14. GET /user/clusters?all=true returned 302 on 2026-07-14 (redirected — the all variant requires session/org context).

Cloud credentials

GET /user/credentials

List the authenticated user’s cloud credentials.

• Auth: Token.

Query parameters:

Response: 200 OK — an array of CloudCredentialApiForm objects. Each embeds a cloudv1alpha1.CredentialSpec (a Kubernetes-style object) plus a creationTimestamp field; the credential fields themselves are free-form (provider-specific).

Verified: GET /user/credentials returned 200 against appscode on 2026-07-14.

GET /user/credentials/{credName}

Get a single cloud credential by name.

• Auth: Token.

Path parameters:

Response: 200 OK — a CloudCredentialApiForm object; 404 if not found.

POST /user/credentials

Create a cloud credential for the authenticated user.

• Auth: Token.

Request body: a cloudv1alpha1.CredentialSpec — a Kubernetes-style object. The exact fields are provider-specific; the API passes the object through as an arbitrary Kubernetes object rather than a fixed schema.

Response: 201 Created with no body.

PUT /user/credentials

Update a cloud credential for the authenticated user. Registered at the path /user/credentials/ (with a trailing slash).

• Auth: Token.

Request body: a cloudv1alpha1.CredentialSpec — a Kubernetes-style object (see POST above).

Response: 204 No Content.

DELETE /user/credentials/{credName}

Delete a cloud credential by name.

• Auth: Token.

Path parameters:

Response: 204 No Content; 404 if not found.

GET /user/clouds/{cloud}/buckets

List storage buckets for a cloud provider.

• Auth: Token.

Note: Despite being a GET, this endpoint is bound to a JSON request body (BucketListOptions). Either a cloud credential or a secret namespace + name must be provided, plus a cluster UID. Because it requires a body it was not exercised as part of live GET verification.

Path parameters:

Request body: BucketListOptions.

{
  "credential": "my-gcs-cred",
  "gce_project": "my-project",
  "cluster_uid": "<uid>",
  "secret_namespace": "",
  "secret_name": "",
  "provider": "gcs"
}

Response: 200 OK — a BucketListResponse.

{
  "names": ["bucket-a", "bucket-b"]
}

Name & email validation

Each validation endpoint returns a Validation object whose Status is one of VALID, USER_EXISTS, RESERVED, INVALID, or NOT_ALLOWED.

POST /user/validate/username

Validate username availability.

• Auth: Token.

Query parameters:

Response: 200 OK — a Validation object.

{ "Status": "VALID" }

POST /user/validate/orgname

Validate organization-name availability.

• Auth: Token.

Query parameters:

Response: 200 OK — a Validation object.

POST /user/validate/email

Validate email availability.

• Auth: Token.

Query parameters:

Response: 200 OK — a Validation object.

Inbox subscriptions

GET /user/inbox/subscriptions

List the inbox subscriptions of the authenticated user, across every scope (organization, cluster, namespace, resource). The caller is always the subscriber — there is no way to list someone else’s subscriptions.

• Auth: Token.

Query parameters: every parameter is an optional exact-match filter; omit them all to get every subscription the caller has.

Response: 200 OK — an array of InboxSubscription:

[
  {
    "id": 12,
    "subscriberID": 4,
    "subscriberType": "individual",
    "scope": "resource",
    "orgID": "3",
    "orgName": "appscode",
    "clusterOwnerID": 3,
    "clusterUID": "<cluster-uid>",
    "clusterName": "arnob-dev",
    "namespaceUID": "<namespace-uid>",
    "namespaceName": "demo",
    "apiGroup": "kubedb.com",
    "version": "v1",
    "resource": "mongodbs",
    "resourceName": "mgo",
    "resourceUID": "<object-uid>",
    "createdAt": "2026-07-14T09:12:01Z",
    "updatedAt": "2026-07-14T09:12:01Z"
  }
]

Subscriptions are created and removed through the scope-specific endpoints: organization and cluster / namespace / resource.

Deployment orders

A deployment order captures a chart selection (a releases.x-helm.dev/v1alpha1 Order) so it can be previewed and then applied. Creating an order stores it as order.yaml in the platform’s package blob store under the generated order UID; the preview routes read it back and render it. The order UID is the {id} path parameter of every route below, and the render routes additionally require the platform’s Helm chart registry to be reachable.

POST /user/deploy/orders

Create a deployment order.

• Auth: Token.

Request body: an Order (releases.x-helm.dev/v1alpha1). spec.packages must be non-empty. metadata.uid and metadata.creationTimestamp are assigned by the server; metadata.name defaults to the release name of the first package.

Response: 200 OK — the stored Order, with the server-assigned metadata.uid. Use that UID as {id} below.

Errors: 400 when spec.packages is empty.

GET /user/deploy/orders/{id}/render/manifest

Render the order into a single concatenated manifest.

• Auth: Token.

Path parameters:

Response: 200 OK — the rendered manifest as a raw response body (not JSON).

GET /user/deploy/orders/{id}/render/resources

Render the order into per-chart resource lists.

• Auth: Token.

Path parameters:

Query parameters:

Response: 200 OK — the converted chart templates.

GET /user/deploy/orders/{id}/helm3

Generate a Helm 3 installation script for the order.

• Auth: Token.

Path parameters:

Response: 200 OK — the generated script.

GET /user/deploy/orders/{id}/yaml

Generate a kubectl-oriented YAML installation script for the order.

• Auth: Token.

Path parameters:

Response: 200 OK — the generated script.