Admin: Users

List, update, and delete user accounts.

Full CRUD access over all user accounts. Password hashes and TOTP secrets are never returned.

List Users

GET/api/admin/users

Param	Description
limit	Max results (default 100, max 500)
offset	Pagination offset
q	Search by email or name (case-insensitive substring)

bash

curl "https://cifp.vril.dev/api/admin/users?q=alice&limit=20" \
  -H "Cookie: authjs.session-token=your-admin-session"

Response

{
  "users": [
    {
      "id":            "uuid",
      "email":         "alice@example.com",
      "name":          "Alice",
      "role":          "user",
      "totpEnabled":   true,
      "emailVerified": "2026-06-01T10:00:00Z",
      "whopUserId":    "wh_user_xxx",
      "createdAt":     "2026-06-01T09:00:00Z"
    }
  ],
  "total": 1,
  "limit": 20,
  "offset": 0
}

Get User

GET/api/admin/users/:id

Returns user details plus their associated tenant record.

bash

curl https://cifp.vril.dev/api/admin/users/user-uuid \
  -H "Cookie: authjs.session-token=your-admin-session"

Response

{
  "id":    "uuid",
  "email": "alice@example.com",
  "role":  "user",
  "tenant": {
    "id":                   "tenant_xxx",
    "plan":                 "pro",
    "whopAccessLevel":      "customer",
    "whopMembershipStatus": "active",
    "createdAt":            "2026-06-01T09:00:00Z"
  }
}

Update User

PATCH/api/admin/users/:id

Field	Description
name	Update display name
role	user or admin — promotes/demotes admin access
emailVerified	true to mark as verified, false to unverify
password	Admin-initiated password reset (min 12 chars, stored bcrypt)

bash

# Promote to admin
curl -X PATCH https://cifp.vril.dev/api/admin/users/user-uuid \
  -H "Cookie: authjs.session-token=your-admin-session" \
  -H "Content-Type: application/json" \
  -d '{"role": "admin"}'

# Reset password
curl -X PATCH https://cifp.vril.dev/api/admin/users/user-uuid \
  -d '{"password": "NewSecurePassword123!"}'

Delete User

DELETE/api/admin/users/:id

Irreversible cascade delete

Deletes the user and all their data: tenant record, all proxies (VMs are also destroyed), all secrets, credentials, rules, and logs. This cannot be undone.

bash

curl -X DELETE https://cifp.vril.dev/api/admin/users/user-uuid \
  -H "Cookie: authjs.session-token=your-admin-session"

# Returns 204 No Content