People and teams
Two grants reach the household's people. people.read lets your app see who's here, so it can show names and pictures or offer to share with someone. people.manage lets it look after accounts and teams, the way does.
Seeing who's here
With people.read, call with your token alone:
| Request | What it gives |
|---|---|
GET /api/people/app |
{"people": [...]}, everyone who can sign in now |
GET /api/people/app/{id}/picture |
Their photo, or 404 |
Each person has id, username, name, role, picture, jobTitle, managerId and parents. picture is "" for initials, preset:<name> for one of Solel's pictures, or the path of their photo, fetched with your token. parents lists a child's parents, so your app can ask one of them first; it's empty for everyone else. Nothing private comes with them: no email address, and nothing about how they sign in.
GET /api/groups, acting for a person, lists the household's groups.
Looking after people
These act for a person, and work only when that person is the owner or an admin and your app has people.manage:
| Request | What it does |
|---|---|
GET /api/people |
Everyone, with all their details |
POST /api/people |
Makes an account: username, displayName, email, role, and a password or "invite": true. A child needs parents, and guests can take expiresAt |
PATCH /api/people/{id} |
Changes role, disabled, solsAllowed, email, jobTitle, phone, managerId or externalId |
POST /api/people/{id}/invite |
A set-up link for someone with no password yet |
POST /api/people/{id}/password-link |
Takes their password away, signs them out, and answers {"link", "emailed"} so they can choose a new one |
DELETE /api/people/{id}/two-factor |
Takes away their second step |
DELETE /api/people/{id}/sessions |
Signs them out everywhere |
POST /api/people/{id}/leave |
Turns their account off and hands things over: mailTo and filesTo (people's ids), reply, keepDays for their mailbox (90 unless you say), and forgetSignIn |
DELETE /api/people/{id}/leave |
Turns a leaver's account back on, with their mailbox if it's still kept |
POST /api/groups, PATCH /api/groups/{id}, DELETE /api/groups/{id} |
Makes, changes and removes groups: name, members, kind (group or team), parentId, email and signIn (two-factor or passkey) |
GET /api/mailhost |
The server's mail domain and its addresses, to read only |
An app can't make or change the owner or admins, whoever it acts for. That stays in Settings › People. See People: adults, children and guests.
A helpdesk
When your app lets someone help on an admin's behalf, act for the admin and name the helper in X-Solel-Helper. For a password link, a second step taken away or signing someone out, the notice to the person and the activity log then say who helped.
The activity log
With audit.read, GET /api/audit reads the activity log for the owner or an admin, newest first. It takes limit (1 to 1,000, 200 unless you say), before (an entry's id), and since and until as RFC 3339 times.