# Users

User management

## Fetch a list of Users

`GET /users`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Parameters:

- `userId` (query, string, optional) - Can only be used by admin or manager users
  Type: string

- `limit` (query, integer, optional) - Limit the number of returned results
  Type: integer

- `offset` (query, integer, optional) - Offset for pagination
  Type: integer

- `keyword` (query, string, optional) - Search keyword filter (searches name, email)
  Type: string

Responses:

- 200: OK

Content type: application/json

Type: Array<User>

Items:
  Reference: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md); Type: User

- 400: No Permission

## Examples

### cURL

```bash
curl -X GET 'https://demo.traccar.org/api/users' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/users', {
  method: 'GET',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
  },
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.get(
    'https://demo.traccar.org/api/users',
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    },
)
print(response.text)
```


## Create a User

`POST /users`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Request body: application/json (required)

Type: User

Schema: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md)

- `id` (optional)
  Type: integer, int64
  
  Unique user identifier

- `name` (optional)
  Type: string
  
  User display name

- `email` (optional)
  Type: string
  
  Email address used for login and notifications

- `phone` (optional)
  Type: string; nullable
  
  Contact phone number for alerts

- `readonly` (optional)
  Type: boolean
  
  When true, the user cannot change settings

- `administrator` (optional)
  Type: boolean
  
  Grants full administrative privileges when enabled

- `map` (optional)
  Type: string; nullable
  
  Preferred default map layer for the user

- `latitude` (optional)
  Type: number
  
  Default map center latitude for this user

- `longitude` (optional)
  Type: number
  
  Default map center longitude for this user

- `zoom` (optional)
  Type: integer
  
  Default map zoom level on login

- `password` (optional)
  Type: string
  
  Password for user authentication

- `coordinateFormat` (optional)
  Type: string; nullable
  
  Preferred coordinate display format

- `disabled` (optional)
  Type: boolean
  
  Indicates whether the user account is disabled

- `expirationTime` (optional)
  Type: string, date-time; nullable
  
  in ISO 8601 format. eg. `1963-11-22T18:30:00Z`

- `deviceLimit` (optional)
  Type: integer
  
  Maximum number of devices the user can manage

- `userLimit` (optional)
  Type: integer
  
  Maximum number of subordinate users

- `deviceReadonly` (optional)
  Type: boolean
  
  Restricts user from modifying device attributes

- `limitCommands` (optional)
  Type: boolean
  
  Prevents user from sending unsupported commands

- `fixedEmail` (optional)
  Type: boolean
  
  Locks the email field to avoid changes

- `poiLayer` (optional)
  Type: string; nullable
  
  External POI layer configured for the user

- `attributes` (optional)
  Type: object
  
  Additional custom user attributes

Responses:

- 200: OK

Content type: application/json

Type: User

Schema: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md)

- `id` (optional)
  Type: integer, int64
  
  Unique user identifier

- `name` (optional)
  Type: string
  
  User display name

- `email` (optional)
  Type: string
  
  Email address used for login and notifications

- `phone` (optional)
  Type: string; nullable
  
  Contact phone number for alerts

- `readonly` (optional)
  Type: boolean
  
  When true, the user cannot change settings

- `administrator` (optional)
  Type: boolean
  
  Grants full administrative privileges when enabled

- `map` (optional)
  Type: string; nullable
  
  Preferred default map layer for the user

- `latitude` (optional)
  Type: number
  
  Default map center latitude for this user

- `longitude` (optional)
  Type: number
  
  Default map center longitude for this user

- `zoom` (optional)
  Type: integer
  
  Default map zoom level on login

- `password` (optional)
  Type: string
  
  Password for user authentication

- `coordinateFormat` (optional)
  Type: string; nullable
  
  Preferred coordinate display format

- `disabled` (optional)
  Type: boolean
  
  Indicates whether the user account is disabled

- `expirationTime` (optional)
  Type: string, date-time; nullable
  
  in ISO 8601 format. eg. `1963-11-22T18:30:00Z`

- `deviceLimit` (optional)
  Type: integer
  
  Maximum number of devices the user can manage

- `userLimit` (optional)
  Type: integer
  
  Maximum number of subordinate users

- `deviceReadonly` (optional)
  Type: boolean
  
  Restricts user from modifying device attributes

- `limitCommands` (optional)
  Type: boolean
  
  Prevents user from sending unsupported commands

- `fixedEmail` (optional)
  Type: boolean
  
  Locks the email field to avoid changes

- `poiLayer` (optional)
  Type: string; nullable
  
  External POI layer configured for the user

- `attributes` (optional)
  Type: object
  
  Additional custom user attributes

- 400: Bad request

- 401: Unauthorized

## Examples

### cURL

```bash
curl -X POST 'https://demo.traccar.org/api/users' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "id": 0,
  "name": "string",
  "email": "string",
  "phone": "string",
  "readonly": true,
  "administrator": true,
  "map": "string",
  "latitude": 0,
  "longitude": 0,
  "zoom": 0,
  "password": "string",
  "coordinateFormat": "string",
  "disabled": true,
  "expirationTime": "2024-01-15T09:30:00Z",
  "deviceLimit": 0,
  "userLimit": 0,
  "deviceReadonly": true,
  "limitCommands": true,
  "fixedEmail": true,
  "poiLayer": "string",
  "attributes": {}
}'
```

### JavaScript

```javascript
const body = `{
  "id": 0,
  "name": "string",
  "email": "string",
  "phone": "string",
  "readonly": true,
  "administrator": true,
  "map": "string",
  "latitude": 0,
  "longitude": 0,
  "zoom": 0,
  "password": "string",
  "coordinateFormat": "string",
  "disabled": true,
  "expirationTime": "2024-01-15T09:30:00Z",
  "deviceLimit": 0,
  "userLimit": 0,
  "deviceReadonly": true,
  "limitCommands": true,
  "fixedEmail": true,
  "poiLayer": "string",
  "attributes": {}
}`;

const response = await fetch('https://demo.traccar.org/api/users', {
  method: 'POST',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    'Content-Type': 'application/json',
  },
  body,
});

const data = await response.text();
```

### Python

```python
import requests

body = '''{
  "id": 0,
  "name": "string",
  "email": "string",
  "phone": "string",
  "readonly": true,
  "administrator": true,
  "map": "string",
  "latitude": 0,
  "longitude": 0,
  "zoom": 0,
  "password": "string",
  "coordinateFormat": "string",
  "disabled": true,
  "expirationTime": "2024-01-15T09:30:00Z",
  "deviceLimit": 0,
  "userLimit": 0,
  "deviceReadonly": true,
  "limitCommands": true,
  "fixedEmail": true,
  "poiLayer": "string",
  "attributes": {}
}'''

response = requests.post(
    'https://demo.traccar.org/api/users',
    data=body.encode('utf-8'),
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
        'Content-Type': 'application/json',
    },
)
print(response.text)
```


## Generate TOTP secret

`POST /users/totp`

Authentication: no security requirement declared for this operation.

Responses:

- 200: OK

Content type: text/plain

Type: string

- 400: Bad request

## Examples

### cURL

```bash
curl -X POST 'https://demo.traccar.org/api/users/totp'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/users/totp', {
  method: 'POST',
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.post('https://demo.traccar.org/api/users/totp')
print(response.text)
```


## Fetch a User

`GET /users/{id}`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Parameters:

- `id` (path, integer, required)
  Type: integer

Responses:

- 200: OK

Content type: application/json

Type: User

Schema: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md)

- `id` (optional)
  Type: integer, int64
  
  Unique user identifier

- `name` (optional)
  Type: string
  
  User display name

- `email` (optional)
  Type: string
  
  Email address used for login and notifications

- `phone` (optional)
  Type: string; nullable
  
  Contact phone number for alerts

- `readonly` (optional)
  Type: boolean
  
  When true, the user cannot change settings

- `administrator` (optional)
  Type: boolean
  
  Grants full administrative privileges when enabled

- `map` (optional)
  Type: string; nullable
  
  Preferred default map layer for the user

- `latitude` (optional)
  Type: number
  
  Default map center latitude for this user

- `longitude` (optional)
  Type: number
  
  Default map center longitude for this user

- `zoom` (optional)
  Type: integer
  
  Default map zoom level on login

- `password` (optional)
  Type: string
  
  Password for user authentication

- `coordinateFormat` (optional)
  Type: string; nullable
  
  Preferred coordinate display format

- `disabled` (optional)
  Type: boolean
  
  Indicates whether the user account is disabled

- `expirationTime` (optional)
  Type: string, date-time; nullable
  
  in ISO 8601 format. eg. `1963-11-22T18:30:00Z`

- `deviceLimit` (optional)
  Type: integer
  
  Maximum number of devices the user can manage

- `userLimit` (optional)
  Type: integer
  
  Maximum number of subordinate users

- `deviceReadonly` (optional)
  Type: boolean
  
  Restricts user from modifying device attributes

- `limitCommands` (optional)
  Type: boolean
  
  Prevents user from sending unsupported commands

- `fixedEmail` (optional)
  Type: boolean
  
  Locks the email field to avoid changes

- `poiLayer` (optional)
  Type: string; nullable
  
  External POI layer configured for the user

- `attributes` (optional)
  Type: object
  
  Additional custom user attributes

- 401: Unauthorized

- 404: Not found

## Examples

### cURL

```bash
curl -X GET 'https://demo.traccar.org/api/users/0' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/users/0', {
  method: 'GET',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
  },
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.get(
    'https://demo.traccar.org/api/users/0',
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    },
)
print(response.text)
```


## Update a User

`PUT /users/{id}`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Parameters:

- `id` (path, integer, required)
  Type: integer

Request body: application/json (required)

Type: User

Schema: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md)

- `id` (optional)
  Type: integer, int64
  
  Unique user identifier

- `name` (optional)
  Type: string
  
  User display name

- `email` (optional)
  Type: string
  
  Email address used for login and notifications

- `phone` (optional)
  Type: string; nullable
  
  Contact phone number for alerts

- `readonly` (optional)
  Type: boolean
  
  When true, the user cannot change settings

- `administrator` (optional)
  Type: boolean
  
  Grants full administrative privileges when enabled

- `map` (optional)
  Type: string; nullable
  
  Preferred default map layer for the user

- `latitude` (optional)
  Type: number
  
  Default map center latitude for this user

- `longitude` (optional)
  Type: number
  
  Default map center longitude for this user

- `zoom` (optional)
  Type: integer
  
  Default map zoom level on login

- `password` (optional)
  Type: string
  
  Password for user authentication

- `coordinateFormat` (optional)
  Type: string; nullable
  
  Preferred coordinate display format

- `disabled` (optional)
  Type: boolean
  
  Indicates whether the user account is disabled

- `expirationTime` (optional)
  Type: string, date-time; nullable
  
  in ISO 8601 format. eg. `1963-11-22T18:30:00Z`

- `deviceLimit` (optional)
  Type: integer
  
  Maximum number of devices the user can manage

- `userLimit` (optional)
  Type: integer
  
  Maximum number of subordinate users

- `deviceReadonly` (optional)
  Type: boolean
  
  Restricts user from modifying device attributes

- `limitCommands` (optional)
  Type: boolean
  
  Prevents user from sending unsupported commands

- `fixedEmail` (optional)
  Type: boolean
  
  Locks the email field to avoid changes

- `poiLayer` (optional)
  Type: string; nullable
  
  External POI layer configured for the user

- `attributes` (optional)
  Type: object
  
  Additional custom user attributes

Responses:

- 200: OK

Content type: application/json

Type: User

Schema: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md)

- `id` (optional)
  Type: integer, int64
  
  Unique user identifier

- `name` (optional)
  Type: string
  
  User display name

- `email` (optional)
  Type: string
  
  Email address used for login and notifications

- `phone` (optional)
  Type: string; nullable
  
  Contact phone number for alerts

- `readonly` (optional)
  Type: boolean
  
  When true, the user cannot change settings

- `administrator` (optional)
  Type: boolean
  
  Grants full administrative privileges when enabled

- `map` (optional)
  Type: string; nullable
  
  Preferred default map layer for the user

- `latitude` (optional)
  Type: number
  
  Default map center latitude for this user

- `longitude` (optional)
  Type: number
  
  Default map center longitude for this user

- `zoom` (optional)
  Type: integer
  
  Default map zoom level on login

- `password` (optional)
  Type: string
  
  Password for user authentication

- `coordinateFormat` (optional)
  Type: string; nullable
  
  Preferred coordinate display format

- `disabled` (optional)
  Type: boolean
  
  Indicates whether the user account is disabled

- `expirationTime` (optional)
  Type: string, date-time; nullable
  
  in ISO 8601 format. eg. `1963-11-22T18:30:00Z`

- `deviceLimit` (optional)
  Type: integer
  
  Maximum number of devices the user can manage

- `userLimit` (optional)
  Type: integer
  
  Maximum number of subordinate users

- `deviceReadonly` (optional)
  Type: boolean
  
  Restricts user from modifying device attributes

- `limitCommands` (optional)
  Type: boolean
  
  Prevents user from sending unsupported commands

- `fixedEmail` (optional)
  Type: boolean
  
  Locks the email field to avoid changes

- `poiLayer` (optional)
  Type: string; nullable
  
  External POI layer configured for the user

- `attributes` (optional)
  Type: object
  
  Additional custom user attributes

- 400: Bad request

- 401: Unauthorized

## Examples

### cURL

```bash
curl -X PUT 'https://demo.traccar.org/api/users/0' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "id": 0,
  "name": "string",
  "email": "string",
  "phone": "string",
  "readonly": true,
  "administrator": true,
  "map": "string",
  "latitude": 0,
  "longitude": 0,
  "zoom": 0,
  "password": "string",
  "coordinateFormat": "string",
  "disabled": true,
  "expirationTime": "2024-01-15T09:30:00Z",
  "deviceLimit": 0,
  "userLimit": 0,
  "deviceReadonly": true,
  "limitCommands": true,
  "fixedEmail": true,
  "poiLayer": "string",
  "attributes": {}
}'
```

### JavaScript

```javascript
const body = `{
  "id": 0,
  "name": "string",
  "email": "string",
  "phone": "string",
  "readonly": true,
  "administrator": true,
  "map": "string",
  "latitude": 0,
  "longitude": 0,
  "zoom": 0,
  "password": "string",
  "coordinateFormat": "string",
  "disabled": true,
  "expirationTime": "2024-01-15T09:30:00Z",
  "deviceLimit": 0,
  "userLimit": 0,
  "deviceReadonly": true,
  "limitCommands": true,
  "fixedEmail": true,
  "poiLayer": "string",
  "attributes": {}
}`;

const response = await fetch('https://demo.traccar.org/api/users/0', {
  method: 'PUT',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    'Content-Type': 'application/json',
  },
  body,
});

const data = await response.text();
```

### Python

```python
import requests

body = '''{
  "id": 0,
  "name": "string",
  "email": "string",
  "phone": "string",
  "readonly": true,
  "administrator": true,
  "map": "string",
  "latitude": 0,
  "longitude": 0,
  "zoom": 0,
  "password": "string",
  "coordinateFormat": "string",
  "disabled": true,
  "expirationTime": "2024-01-15T09:30:00Z",
  "deviceLimit": 0,
  "userLimit": 0,
  "deviceReadonly": true,
  "limitCommands": true,
  "fixedEmail": true,
  "poiLayer": "string",
  "attributes": {}
}'''

response = requests.put(
    'https://demo.traccar.org/api/users/0',
    data=body.encode('utf-8'),
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
        'Content-Type': 'application/json',
    },
)
print(response.text)
```


## Delete a User

`DELETE /users/{id}`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Parameters:

- `id` (path, integer, required)
  Type: integer

Responses:

- 204: No Content

- 401: Unauthorized

## Examples

### cURL

```bash
curl -X DELETE 'https://demo.traccar.org/api/users/0' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/users/0', {
  method: 'DELETE',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
  },
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.delete(
    'https://demo.traccar.org/api/users/0',
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    },
)
print(response.text)
```