> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leadscoutapp.com/llms.txt
> Use this file to discover all available pages before exploring further.
# REST API endpoints for managing users and team members
> List your team, invite new users by email and role, update user profiles and permissions, and remove members. Most endpoints require admin or owner role.
The users and invites endpoints give you programmatic control over your LeadScout team. You can list current members, invite new reps or admins by email, update a user's role and permissions, and remove users who have left the team. Most of these endpoints require the `admin` or `owner` role — a `sales` user can read the team list but cannot manage it.
## List team members
```
GET /api/users
```
Returns all active (non-deleted) users in your company, ordered newest first.
```bash cURL theme={null}
curl --request GET \
--url https://app.leadscoutapp.com/api/users \
--header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```
```javascript JavaScript theme={null}
const response = await fetch('https://app.leadscoutapp.com/api/users', {
headers: { Authorization: `Bearer ${accessToken}` },
});
const users = await response.json();
```
### Response
Returns an array of user objects directly.
User ID.
First name.
Last name.
Email address.
Phone number.
`owner`, `admin`, or `sales`.
Whether this user can perform prospect management actions regardless of role.
Whether this user can create and modify tags regardless of role.
Whether this is the primary account holder.
IANA time zone string.
Whether the app auto-detects the user's time zone.
Start of working hours (e.g. `"08:00"`).
End of working hours (e.g. `"17:00"`).
Appointment buffer time in minutes.
Whether the user prefers 24-hour time display.
Whether the user's calendar shows all company events.
ISO 8601 creation timestamp.
***
## Invite a user
```
POST /api/invites
```
Inviting users requires the `admin` or `owner` role. Requests from `sales` users return `403`.
Sends an invitation for a new team member. The invite is stored and the invitee receives an email with instructions to complete sign-up. You can only invite users with the `admin` or `sales` role — the `owner` role cannot be assigned through invitations.
### Request body
Invitee's first name.
Invitee's last name.
Must be a valid email address. Used as the login identifier.
Optional phone number for the invitee.
Role to grant on acceptance. Must be `admin` or `sales`.
ISO 8601 timestamp after which the invite link expires. If omitted, the invite does not expire.
Returns `201` with the created invite object on success.
```bash cURL theme={null}
curl --request POST \
--url https://app.leadscoutapp.com/api/invites \
--header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
"firstName": "Alex",
"lastName": "Rivera",
"email": "alex.rivera@example.com",
"role": "sales",
"expiresAt": "2024-12-31T23:59:59Z"
}'
```
```javascript JavaScript theme={null}
const response = await fetch('https://app.leadscoutapp.com/api/invites', {
method: 'POST',
headers: {
Authorization: `Bearer ${accessToken}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
firstName: 'Alex',
lastName: 'Rivera',
email: 'alex.rivera@example.com',
role: 'sales',
expiresAt: '2024-12-31T23:59:59Z',
}),
});
const invite = await response.json();
```
***
## Update a user
```
PATCH /api/users/:id
```
Updating another user's role or permissions (`role`, `isPrimary`, `canManageTags`, `canManageProspects`) requires the `canManageTeam` permission, which is granted to `admin` and `owner` roles. Users can update their own profile fields (name, email, phone, time zone, calendar preferences) without elevated permissions.
All body fields are optional. Only the fields you send are updated.
### Path parameters
The user ID to update.
### Request body
**Profile fields (any user can update on themselves):**
First name. Must be at least 1 character.
Last name. Must be at least 1 character.
Valid email address.
Phone number. Pass `null` to clear.
IANA time zone string (e.g. `America/Detroit`).
Whether to auto-detect time zone from the device.
Working hours start time string (e.g. `"08:00"`).
Working hours end time string (e.g. `"17:00"`).
Integer appointment buffer in minutes.
Whether to display times in 24-hour format.
Whether the calendar shows all company events.
**Admin/owner only fields:**
New role: `owner`, `admin`, or `sales`.
Whether to mark this user as the primary account holder.
Grant or revoke tag management permission.
Grant or revoke prospect management permission.
```bash cURL theme={null}
curl --request PATCH \
--url https://app.leadscoutapp.com/api/users/14 \
--header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
"role": "admin",
"canManageProspects": true
}'
```
```javascript JavaScript theme={null}
const response = await fetch('https://app.leadscoutapp.com/api/users/14', {
method: 'PATCH',
headers: {
Authorization: `Bearer ${accessToken}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
role: 'admin',
canManageProspects: true,
}),
});
const updated = await response.json();
```
***
## Remove a user
```
DELETE /api/users/:id
```
Removing a user requires the `admin` or `owner` role. The user's prospects and activity history are preserved, but they can no longer sign in.
### Path parameters
The user ID to remove.
Returns `{ "id": }` on success.
```bash cURL theme={null}
curl --request DELETE \
--url https://app.leadscoutapp.com/api/users/14 \
--header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```
```javascript JavaScript theme={null}
await fetch('https://app.leadscoutapp.com/api/users/14', {
method: 'DELETE',
headers: { Authorization: `Bearer ${accessToken}` },
});
```