comecerodocs
Users

Get a user

GET
/users/{user_id}

Gets one user. A trusted token may always read its own user with me, even without the users read permission. Reading any other user needs a secret or trusted token with that permission. A user of the other mode is not found (404).

Authorization

headerAuthorizationBearer <token>

A secret, trusted or limited token. See Authentication.

Path Parameters

user_id*string

The user's user_id. With a trusted token, me means the signed-in user. me with any other token type is 403.

Query Parameters

formatted?boolean

When true, the object also has a formatted child with amounts and dates as display text in the shopper's language and currency (for example $19.99 or November 7, 2026). The default is false. See Localized formatting.

Defaultfalse
show?string

Comma-separated fields to return; all others are left out. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.

hide?string

Comma-separated fields to leave out of the response. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.

timezone?string

An IANA time zone name, such as America/New_York or UTC. It sets how date_start and date_end are read and the time zone of every date in the response. The default is the account's time zone (Settings, Technical), or UTC when it has none. A name that is not known is a 400.

Response Body

The user.

application/json
  1. response

A person who can sign in to your dashboard. Users are kept per mode: test users and live users are separate, and a test user's user_id ends in .test. When a user signs in, they get a trusted token with the user's permissions.

object?"user"

The object type. Always user.

Value in"user"
url?string

The URL of this user.

Formaturi
user_id?string

The user's sign-in name, in lower case. A test user's ends in .test.

test?boolean

True for a test user.

date_created?string

When the user was created.

Formatdate-time
date_modified?string

When the user was last changed.

Formatdate-time
account_id?string

The account the user belongs to.

account_alias?|

The alias of your account, which users may sign in with instead of the account ID.

account_live?boolean

True when your account may take live payments.

name?string

The user's full name.

Lengthlength <= 75
email?string

The user's email address. Each user needs their own, across test and live users.

Formatemail
Lengthlength <= 100
is_account_owner?boolean

True for an owner of the account. The user who signed up is an owner.

language?|

The user's language, as a two-letter ISO 639-1 code in lower case.

locale?|

The locale of the user's browser, such as en-US, saved each time they sign in. Null until they first sign in.

date_last_login?|

When the user last signed in. Null if they never have.

Formatdate-time
allow_test_transactions?boolean

True when the user may work in test mode.

roles?array<string>

The role_id of each role given to the user.

permissions?array<>

The permissions given to the user directly. Where a role and a permission disagree, the more generous one wins.

effective_permissions?

What the token or user may really do, after its roles and permissions are combined and cut down to what its token type allows. Each key is a resource and each value says which methods are allowed on it.

meta?|

Your own data about the user, any JSON up to 2,048 characters.

formatted?

Display text for the dates. Only present when you send formatted=true.

Example Request
curl -X GET 'https://api.comecero.com/api/v1/users/jane.smith.test'
Example Response
{  "object": "user",  "url": "https://api.comecero.com/api/v1/users/jane.smith.test",  "user_id": "jane.smith.test",  "test": true,  "date_created": "2026-10-01T14:36:52Z",  "date_modified": "2026-10-01T14:36:52Z",  "account_id": "AB1234",  "account_alias": "example-shop",  "account_live": true,  "name": "Jane Smith",  "email": "jane@example.com",  "is_account_owner": false,  "language": "en",  "locale": "en-US",  "date_last_login": "2026-11-06T09:12:40Z",  "allow_test_transactions": true,  "roles": [    "support"  ],  "permissions": [],  "effective_permissions": {    "orders": {      "create": false,      "read": true,      "update": true,      "delete": false    }  },  "meta": null}

Create a user POST

Adds a user who can sign in to your dashboard, in the mode of the token you call with. A user made with a test token is a test user and its `user_id` gets `.test` added. Fires the `user:created` event. Secret and trusted tokens may call this with the `users` create permission.

Update a user POST

Changes a user. Only the fields you send change. Fires the `user:modified` event. A trusted token may always update its own user with `me`, even without the `users` update permission. On `me` only `name`, `email`, `password` and `language` are used; other fields are ignored. Updating any other user needs a secret or trusted token with that permission.