User management
Users are the core record in CSI Auth. This page covers the user model your app needs to understand: what identifies a user, what the two metadata objects mean, and the difference between blocking and deleting an account. The operations themselves, creating a user, finding one, updating it, are exposed through the CSI API reference, and this page explains what each one actually does.
The user record
A user is identified by a user_id that combines the connection and the provider’s identifier, for
example auth0|64c1f0a2b3d4e5f60718293a. The identifier is opaque; do not parse it.
Creating a user
Users are created against a specific database connection. Users from enterprise or social connections are created on first login instead, so they are never created through the API.
Finding users
By id
The fastest lookup, and the only one that is immediately consistent after a write.
By query
Search accepts a Lucene query over indexed fields. Search results are eventually consistent, so a user created a moment ago may not appear yet.
Pagination
Offset pagination is capped, so narrow the query rather than paging deeply through a large result set.
Updating a user
Only send the fields you are changing. Some fields cannot be changed in the same request as others, and changing an email address has side effects on verification state.
Metadata
Two metadata objects hang off every user, and the difference matters.
Never put an authorization decision in user_metadata.
Blocking and unblocking
Blocking sets a flag that rejects the user’s logins while preserving the account and its history. It is the right response to a suspected compromise or an offboarding that may be reversed.
Blocks raised automatically by brute-force protection are a separate mechanism and are cleared separately.
Deleting a user
Deletion is permanent and is not recoverable through Auth0. Prefer blocking unless a deletion is required.
Related
- Roles and permissions for what a user is allowed to do
- MFA for enrollment and reset