Users API

Base route: /api/users
Auth required: ✅ JWT Bearer

---

GET /api/users

Returns all active users.

Permission: None required (any authenticated user)

Response 200 OK

[
  {
    "id": 1,
    "firstName": "Alice",
    "lastName": "Smith",
    "email": "alice@medregia.com",
    "roleId": 1,
    "isActive": true,
    "createdAt": "2026-01-01T00:00:00Z"
  }
]

---

GET /api/users/:id

Returns a single user by ID.

Permission: None required

Response — Single 200 OK — UserDto

Response — Not Found 404

---

GET /api/users/me/permissions

Returns the resolved, deduplicated permission list for the currently authenticated user.

Permission: None (requires valid JWT only)

Response 200 OK

[
  { "id": 1, "collection": "Vendor", "action": "Read", "description": "View vendors" },
  { "id": 2, "collection": "Vendor", "action": "Create", "description": "Create vendors" },
  { "id": 5, "collection": "Invoice", "action": "Read", "description": "View invoices" }
]

For admin users, returns a single wildcard entry indicating full access.

---

POST /api/users

Creates a new user account.

Permission: User:Create

Request Body

{
  "firstName": "Bob",
  "lastName": "Jones",
  "email": "bob@medregia.com",
  "password": "SecurePass123!",
  "roleId": 2
}

Field	Required	Description
firstName	✅
lastName	✅
email	✅	Must be unique
password	✅	Hashed with BCrypt before storage
roleId	✅	Must reference an existing active role

Response — Created 201 — UserDto (without passwordHash)

Response — Invalid 400 — Validation errors

---

PUT /api/users/:id

Updates an existing user's details.

Permission: User:Update

Request Body

{
  "firstName": "Robert",
  "lastName": "Jones",
  "email": "robert@medregia.com",
  "roleId": 2
}

Response — Updated 200 OK — Updated UserDto

Response — Not Found 404

---

DELETE /api/users/:id

Soft-deletes a user (sets isActive = false).

Permission: User:Delete

Response — Deleted 204 No Content

Response — Not Found 404