Endpoints

The current System API contains 20 operations under /api/v1. Every route requires a valid bearer token with the system_api scope.

Endpoint Groups

• Users — 10 operations
• Roles — 4 operations
• Permissions — 6 operations

Use the tenant origin as the host:

https://your-tenant.guardhouse.cloud/api/v1

Users

Method and route	Operation
POST /users	Create user
GET /users	Get users
GET /users/{userId}	Get user by ID
PUT /users/{userId}	Update user by ID
PATCH /users/{userId}/block	Block user by ID
PATCH /users/{userId}/unblock	Unblock user by ID
POST /users/{userId}/password	Change user password
POST /users/{userId}/roles/{roleId}	Assign user to role
DELETE /users/{userId}/roles/{roleId}	Unassign user from role
PUT /users/{userId}/personal-data	Delete user personal data

Roles

Method and route	Operation
POST /roles	Create role
GET /roles	Get roles
GET /roles/{roleId}	Get role by ID
PUT /roles/{roleId}	Update role by ID

Permissions

Method and route	Operation
POST /permissions	Create permission
GET /permissions	Get permissions
GET /permissions/{permissionId}	Get permission by ID
PUT /permissions/{permissionId}	Update permission by ID
POST /roles/{roleId}/permissions	Add permissions to role
DELETE /roles/{roleId}/permissions	Remove permissions from role

Conventions

• IDs are positive integers.
• Send JSON request bodies with Content-Type: application/json.
• Creation and reads return JSON; most updates and actions return 204 No Content.
• Personal-data deletion is the documented PUT /users/{userId}/personal-data operation. There is no external generic user DELETE route.
• See each operation for its exact body, result, and business-rule errors.

See Errors and limits for shared status-code, parsing, pagination, and retry guidance.