API Reference

The Guardhouse System API lets trusted backend services manage users, roles, and permissions in their own Guardhouse tenant.

Base URL And Authentication

All operations use your tenant origin and the versioned base path:

https://your-tenant.guardhouse.cloud/api/v1

Every operation requires an access token issued to a Backend / Service client with System API Access enabled and the system_api scope. The server enforces that scope on all 22 operations.

Privileged credential

A System API client can change identity and access-control data. Store its secret only in a trusted backend secret store, use a separate client per environment, and rotate it after suspected exposure.

Structure

• Getting Access Credentials
• Configure System API Client
• Use Credentials Programmatically
• Endpoints Overview
• Users: 12 operations
• Roles: 4 operations
• Permissions: 6 operations

Implemented Surface

The reference documents the server's complete external System API:

• 12 user operations for creation, lookup, profile and verified-email updates, suspension, passwords, role assignment, and personal-data deletion
• 4 role operations for creation, lookup, listing, and updates
• 6 permission operations for creation, lookup, listing, updates, and role membership

Undocumented dashboard endpoints are not part of the public API contract and can change without notice. Manage clients, resources, branding, providers, and tenant configuration through the supported dashboard workflows.

Response Conventions

• Create and read operations normally return 200 OK with JSON.
• Updates and actions normally return 204 No Content.
• Validation and business-rule failures use 400, 404, or 409 as described by each endpoint page.
• Error JSON is not consistently RFC 7807 Problem Details. See Errors and limits before implementing parsing or retries.

The .NET SDK has typed clients for every documented operation. Node.js and Python can call the same routes with generic authenticated HTTP helpers.