Documentation was generated on 2026-08-21T16:07:03.288Z
Removes one or more scopes from a system role.
Deletes a user. Response has status code 200 if successful. pub.user-service.user-deleted is published after deletion
Gets users. Response has status code 200 if successful. Note that any query params will be used as a mongo query.
Gets user by id. Response has status code 200 if successful.
Adds one or more scopes to a system role.
Creates a fruster user. Must include a few base fields but can contain any number of custom fields. Response has status code 201 if successful. Automatically splits data between user and profile if configured to.
Updates a user. Can contain any number of custom fields. Response has status code 200 if successful.
Returns wether the app is in demo mode. Can be used during app reviews or similar.
Will return a Set-Cookie to instruct browser to expire any existing cookie and delete the session of the token (from cookie or Authorization Bearer-header) from the database. Should be used by both Token and Cookie.
Note: When using the query param logoutId the id is obtained from GET to /auth/active-sessions which can only be done by the logged in user.
Gets all active sesssions for the logged in user, typically to be used to list sessions similar to something like google or facebook with the ability to logout any session:

Will return all values as null (expect for id) if user hasn't been active since the session details functionality was implemented (sometime around 2020-06-11).
Disables Two Factor Authentication via SMS for the user. Will remove the sms from the user's two factor authentication methods.
Enables Two Factor Authentication via SMS for the user. Will send a SMS to the provided phone number with a code that the user needs to input to enable TFA. The code is valid for 10 minutes.
Gets a fresh access token by providing a refresh token.
Verify code and return auth tokens
Login for non web devices such as native mobile apps. Returns an access token to be used as bearer authentication. Response body also contains profile which has the same data as user-service.get-users-by-query with expand: "profile" but for the logged in user.
Verifies the Two Factor Authentication code sent to the user via SMS. Will return a Set-Cookie with the new session token if the code is correct. The code is valid for 10 minutes.
Get consultants that are booked on shifts or absent within a date range, with the calendar days they are busy on
Deletes agreements for a candidate
Get recruitment history by candidate id
Sends employment contract to candidate
Send message to the candidate
Send message to multiple candidates in bulk
Recruit a candidate as a consultant
Update recruitment details of the candidate
Update recruitment details of multiple candidates in bulk
Delete a collective agreement by id
Get a collective agreement by id
Get consultants using a specific collective agreement
Update a collective agreement
Get guaranteed hours progress for a consultant in a given month.
This endpoint for show salary in the consultant view
This endpoint for get salary summary
Deletes agreements for a consultant
Delete consultant absence record
Unblock consultant for specific customer
Delete a rating of a consultant
Get consultant absence records
Get block customers for a consultant
Generate a presentation for a consultant account
Get one page of the consultant event timeline, newest first. Internal users only.
Sends employment contract to consultant
Add consultant absence record
Block consultant for specific customer
Add a rating to a consultant
Send notifications to list of consultants
Update consultant absence record
Deactivate consultant account
Set password for consultant account directly (admin action)
Get the organisation's current consultant sync version. The counter is bumped on every consultant-mutating operation, so clients can poll it to detect stale consultant list caches. Returns 0 when no consultant write has been recorded yet.
Delete a ob rule
Get ob rules for contract id
Batch update, create, and delete OB rules for a contract
Handles webhook that is posted after employment contract was signed
Delete a corporate group (koncern). Blocked while the group has member customers.
Get a corporate group by id, including its member customers
Create a corporate group (koncern). The group owns the invoice details shared by its member customers.
Update a corporate group (koncern). Changes to the invoice details apply to all member customers at read time.
Get latest contract version competences by customer id, will filter away hidden ones if logged in as customer
Get one page of the customer event timeline, newest first. Internal users only.
Get latest contract version terms by customer id
Find any potential duplicate customers based on address, is used when activating a new customer
Get price for given competences with customer id
Delete a customer account
Get customers by customer user id
Update a customer account
Set password for customer account directly (admin action)
Get the organisation's current customer sync version — a monotonic counter bumped on every customer write. Poll it to decide whether a cached customer list is stale. Returns 0 if no customer write has happened yet.
Manually trigger a rebuild of the dashboard cache for the authenticated user's organisation only.
Get a list of documents with pagination, sorting, and filtering
Uploads a file. Uses multipart data with the file to be uploaded as a form field called 'file'. Max file size is 20 mb. Returns status code 201 on success.
Updates image width, height and/or rotation. Will process images and save in S3.
Activates fortnox integration for the logged in users organisation. This is a one-off operation required to allow Origo to access the clients Fortnox account.
Handles redirect from Fortnox after app was added
Will test the fortnox integration by invoking the Fortnox API, will only perform read operations that are safe.
Returns list of job invitations for logged in consultant
Update a user account by using an invitation token. This is a public endpoint that is used when onboarding new users by sending out invitations.
Downloads a PDF invoice by creating a 'preview' in Fortnox
Credits invoice (so far only available for organisations using Fortnox as invoicing system)
Count customers and time reports that an invoice batch would include, without creating one
Toggles if invoice should be included in invoice batch
Hard-delete a job application so the consultant can re-apply
Download job confirmation for consultant
Download job confirmation for customer
Get the unified event timeline for a job (job history + time report milestones), newest first. Internal users only.
Book consultant for specific job, optionally on an explicit set of its available shifts
Decline job if job has not matching consultants
Create job invitation to consultant by customer user
Accept an invitation as logged in consultant
Decline invitation by consultant
Reopens job that was previously cancelled or denied
Send notification to matching consultant
Update job application status
Update shift for a job. This endpoint is only for customer users.
Change the status of extended required shifts
Get job report by id and token (public endpoint)
Update job report by id (public endpoint)
Delete a knowledge base article (requires knowledge-base.delete permission)
Get a knowledge base article by id
Create a knowledge base article (requires knowledge-base.create permission)
Record feedback (thumbs up/down) for a knowledge base article (requires knowledge-base.feedback permission)
Update a knowledge base article (requires knowledge-base.update permission)
Get knowledge base articles by tags (comma-separated). Returns all articles if no tags provided.
Update the authenticated user's own preferences (merged into profile.preferences)
Delete notification by id
Read bulk notifications of the auth user
Register a FIREBASE device token (aka registrationToken) and user id.
APA91bHUyC8pJNmnEjkDeoeKKjo_i5IXQZef0VkG8aLy3ViYsgY0tuCY4gLGSKsTUuZRWWXyhFscDo-UogugDPfTT04yhPJVR_ELHvGowYXu49c9gvDG7WpUamgvCebLhWppHn8LoLa3H1FbeV6xNSdXh5rl7rABSwUnregisters either a FIREBASE device token (aka "registrationToken") or user id.
- If `registrationToken` is used, all users with that registrationToken are removed from push.
- If `userId` (logged in user) is used, all registrationTokens (devices) for that user will be removed from push.Delete a tag type and cascade delete the tag from every entity carrying it. Consultant tag types used as requirements on active jobs cannot be deleted.
Get competences by organisation id. Archived competences are excluded unless includeArchived=true
Get notification templates and settings by organisation id
Get notification templates by organisation id
Create a tag type in one of the organisation's tag taxonomies. If key is omitted it is slugified from name.sv.
Creates a new notification template
Send a test notification to a specified user using a template
Update an organisation's competence tree: rename, archive/restore or add a competence. Competences are archived rather than deleted so existing jobs keep working.
Update a tag type (name, and validityDuration for the consultant taxonomy). Renames propagate automatically since entities store only the key.
Updates a single notification template
Get all organisation accounts (internal users)
Transfer all consultants from one manager to another within an organisation
Public endpoint to request password reset. Will take users role into account and use different templates depending on it.
Download report file. Only available if EXPOSE_DOWNLOAD is enabled.
Gets whether or not the provided token is still valid for resetting password. Typically used to display a warning to the user before posting new password that the token is invalid.
Requests a password reset to by providing a username. Username is configured to be: email.
Reset user's password with token from password reset-email.
Generates a signed URL to export ZIP
Create a salary batch as preview for provided period, optionally scoped to a selection of consultants
Modify included consultants in the salary batch
Get consultant schedule in given date range.
Get consultant schedule
Get statistics of jobs excel
Delete a subsidiary (dotterbolag). Blocked while consultants or customers belong to it.
Get subsidiary list (recruitmentContract omitted)
Create a subsidiary (dotterbolag). Its identity, recruitmentContract and pools override the parent organisation's values.
Update a subsidiary (dotterbolag).
Publishes time reports to customer users. This can either be done by providing id's of time reports to publish or by providing pool in which all time reports that are already attested by admin will be published.
<p>Update time report by id. NOTE: all user roles use this endpoint to update time reports.</p><p>State sequence. PENDING => NOTWORKED,WORKED => ATTESTEDBYADMIN => ATTESTEDBYCUSTOMER, DECLINEDBYCUSTOMER </p><p>Admin can handle all status. But need to do it in sequence</p><p>Customer can ATTESTEDBYCUSTOMER and DECLINEDBYCUSTOMER. A comment need when decline. Admin will RESOLVEDDECLINEBYADMIN declined time reports </p><p>Consultant can WORKED or NOT_WORKED</p>
Undo time report to previous state. NOTE: Only undo what auth user did. But admin can undo every.
Get contact information to user no mater of role. Is primarily used when need to get contact information from a user id. Only used by dashboard users.
Generates a new email verification token and resends email w/ token to the provided user. Response has status code 200 if successful.
Verifies a user's email address by providing a token sent to the user by email. Response has status code 200 if successful.
Updates password of auth user's account. Requires to validation of old password before new can be set. Response has status code 202 if successful.
Sends a message to a client (user) via websocket, if such connection exists. The message is sent to a userId with a label (in place of the >). If sent to ws.out.e3bcf884-8b49-46ae-8546-8dcc65b56932.new-notification (The label being new-notification) the user will receive the message in the handler registered to new-notification. Can be used to send a global message to all connected users by providing a * as userId. To specify a list of users to send to * is used as userId and req.to is set to an array of userIds.
Sends a message to all connected users. Public and non public connections. The > is the label for the message being sent. E.g. ws.out.public.psa (Where the label is psa). This endpoint will make it possible for the public clients to subscribe to the endpoint without knowing their assigned uuid.
Generates a web JWT token for a user matching the inputted Mongo query. Used for external logins.
Gets session details for a user. Will return all values as null if user hasn't been active since the session details functionality was implemented (sometime around 2020-06-11).
Logs out a list of users. Does not matter if user is logged in via cookie or token.
Gets a fresh access token by providing a refresh token.
Gets an temporary url to a file that will expire after provided or default TTL
Check whether the video file processing is completed or not
Request to (forcefully) unregister (a) websocket client. Can be done by either providing the jwt-token to unregister one connection or the id of the user to unregister all connections for user.
To be used by schedule service. Checks for timed out grouped mails. If any is timeout; The pending mails are sent out as one mail and the batch is decreased (Until 0 and then removed).
Sends a mail that can be grouped.
mails sent using this endpoint will be sent in groups, based off the GROUPED_MAIL_BATCHES config.
mails are grouped by email (taken from the to array) and key.
When used with multiple `email`s in the `to` array, each `email` is grouped individually.
The grouping of mails happens in batches.
Each batch “level” has a `numberOfMessages` (Number of messages before next batch level is reached)
and `timeout` (timeout before level is decreased) defined.
Every time a batch level's `numberOfMessages` is reached, the pending mails are sent out as one mail
and the batch level is increased. Each new batch level will (most commonly) increase `numberOfMessages`
and the `timeout`. If the number of messages is not fulfilled before the timeout is reached,
the mail is sent with all pending grouped mails; then the batch level is decreased.
When a grouped mail is sent out; any `{{n}}` in message and/or title will be replaced
by the number of pending grouped mails at that point. When using templates,
`n` will be added to `templateArgs` and can then be used by the template.
Example: When 56 grouped mails with the key `message-service.NEW_MESSAGE` have been sent w/
the message `You have {{n}}}} new messages!` it becomes:
You have 56 new messages!
Current configuration:
Batch level 1 => numberOfMessages: 1, timeout: 0ms
Batch level 2 => numberOfMessages: 5, timeout: 2m
Batch level 3 => numberOfMessages: 30, timeout: 5m
With this configuration after 36
mails being sent, the email would have received 3 mails;
granted none of the timeouts have been reached.Sends a mail to one or more mails (emails) addresses
Creates a credit invoice for invoice with provided invoice number. Note that invoice must be book kept (in Fortnox) prior to creating a credit invoice.
Removes salary transactions in Fortnox, use with caution! This will only remove the transactions in Fortnox, not the salary batch job in our system.
Creates invoices for provided invoice batch
Updates an InvoiceBatch when oo-fortnox-service finishes processing it
Creates salaries for provided salary batch
Reconciles invoice batch jobs stuck in PROCESSING against Fortnox. Triggered on a cron.
Create Hogia salary export file(s) for provided salary batch
Archive jobs and applications after 3 month after its last shift, archive job reports after 6 month
Create job reports when last shift of the iso week has ended
Performs checks on data in job service, is used to catch inconsistencies in data, should be invoked once every day
Get active jobs for given query (consultant and customer)
Get applications by consultant id
Get booked shifts (from ACCEPTED applications) for multiple consultants within a date range, grouped by consultant
Counts the organisation's active jobs (OPEN, BOOKED, BOOKEDWITHUNMANNED_SHIFTS) whose requirements.tags contain the given consultant tag key.
Calculates a preview of consultant salary. Will perform calculations but not actually make any changes.
This is useful so i.e. consultants can get a hunch of the salary he/she will get or it can be used in reports.
Note that this should **NOT** be mistaken with PreviewSalaryBatch which is something else.Send a push notification to the consultants after shift end
Send a push notification to the consultants to reminder about that shift starts in ~1 hour
Send a push notification to the consultants to reminder about time report
Auto attest time reports which are still not attested by customer
Strips a descriptive job tag (jobTagTypes key) from all jobs of an organisation. Used as the cross-service cascade when the tag type is deleted. Idempotent.
Strips a consultant tag (consultantTagTypes key) from the requirements.tags of all jobs of an organisation. Used as the cross-service cascade when the tag type is deleted. Idempotent.
Create notification
Get a single notification template by organisation id and template name
Get notification templates and settings by organisation id
Record a customer timeline event on behalf of another service. Used for customer users, which live in oo-user-service.
Get an customer by id
Get customers by query
Get ob dates for given contracts and given date range
Get ob dates for given contract ids and a single date range
Get an organisation by id
Get organisations by query
Get price for given competences with customer id
Get price for given competences with contract
Get OB rules by contract IDs for salary calculation
Refresh dashboard cache for all organizations
Bulk invite multiple users by their IDs
Get all blocked consultants
Get active and non delete auth user details for auth service
Get block consultants by a customer
Get block customers for a consultant
Get a collective agreement by id
Get consultants using a specific collective agreement
Get consultants by MongoDB query with flexible filtering, pagination, and sorting
Sends push reminders to consultants whose certifications expire soon, for certification types with reminders enabled. Idempotent sweep triggered by scheduled job.
Send set password mail after activation of the customer
Removes a consultant tag (by key) from all consultants of an organisation. Idempotent sweep used by the consultant-tag-type cascade delete.
Update a consultant account via service
Update consultant's location by their postal code
Update search text for every users. This use by schedule
Works much like the password-reset-service.request-password-reset endpoint but does not send email and returns token in response. Username is configured to be: email
Gets whether or not the provided token is still valid for resetting password. Typically used to display a warning to the user before posting new password that the token is invalid.
Requests a password reset to by providing a username. Username is configured to be: email.
Reset user's password with token from password reset-email.
To be used by schedule service. Checks for timed out grouped notifications. If any is timedout; The pending notifications are sent out as one push and the batch is decreased (Until 0 and then removed).
Sends a push notification to one or many users.
Sends a notification that can be grouped. Notifications sent using this endpoint will be sent in groups, based off the GROUPED_NOTIFICATION_BATCHES config.
Notifications are grouped by userId (taken from the to array) and key. When used with multiple userIds in the to array, each userId is grouped individually.
The grouping of notifications happens in batches. Each batch “level” has a numberOfMessages (Number of messages before next batch level is reached) and timeout (timeout before level is decreased) defined. Every time a batch level's numberOfMessages is reached, the pending notifications are sent out as one push and the batch level is increased. Each new batch level will (most commonly) increase numberOfMessages and the timeout. If the number of messages is not fulfilled before the timeout is reached, the push is sent with all pending grouped notifications; then the batch level is decreased.
When a grouped notification is sent out; any {{n}} will be replaced by the number of pending grouped notifications at that point. Example: When 56 grouped notifications with the key message-service.NEW_MESSAGE have been sent w/ the body You have {{n}}}} new messages! it becomes:
You have 56 new messages!
Current configuration:
Batch level 1 => numberOfMessages: 1, timeout: 0ms
Batch level 2 => numberOfMessages: 5, timeout: 15m
With this configuration after 6 notifications being sent, the user would have received 2 pushes; granted none of the timeouts have been reached.
Sends a push notification to one or many users.
Unregisters all registrationTokens (devices) for the provided user.
A service that accepts JSON (in) and outputs reports in different formats.
Creates or updates (upserts) a new job that runs on a given interval or time. Read more about fruster-schedule-service.
Sends an sms to one or more phone numbers using 46ELKS's sms framework
Adds inputted roles to specified user. Can only add roles existing in configuration. Response has status code 202 if successful.
Sends reminders to consultants to update their availability
Creates a fruster user. Must include a few base fields but can contain any number of custom fields. Response has status code 201 if successful. Automatically splits data between user and profile if configured to.
Deletes a user. Response has status code 200 if successful. pub.user-service.user-deleted is published after deletion
Deletes users by a query. Response has status code 200 if successful. pub.user-service.user-deleted is published after deletion. Request body is the query to delete with. Cannot use empty query.
Gets user records by aggregate without process aggregate result
Gets all scopes for specified roles in a flat array. E.g. input ['admin', 'user', 'super-admin'] would return ['', 'admin.', 'profile.get']. Response has status code 200 if successful.
Gets users by query. Response has status code 200 if successful.
Gets users by aggregate. The result process with view model
Gets users by query. Note: Return data may vary depending on the configuration. Configured user fields: ALL (Will always return id,email,password,roles,scopes)
Can be expanded to return both user and profile data using expand: "profile" if configured to split the data. If expand is used; the query can be used to query profile fields as well: { "profile.firstName": "Bob" }. With expand; the data is returned {...userData, profile: {...profileData}}. Can fetch only user count without users, using count: true. if count is used returns totalCount with empty users array
Removes inputted roles from specified user. Cannot remove the last role. Response has status code 202 if successful.
Generates a new email verification token and resends email w/ token to the provided user. Response has status code 200 if successful.
Sets password of a user. Used by password reset service. Note: Updating a user's password should be done w/ the update-password endpoint. Response has status code 202 if successful.
Updates password of an account. Requires to validation of old password before new can be set. Response has status code 202 if successful.
Updates a user. Can contain any number of custom fields. Response has status code 200 if successful.
Validates that inputted password becomes the same hash as for an account. Typically used by auth service for login. Response has status code 200 if successful. Validation can be done on email
Verifies a user's email address by providing a token sent to the user by email. Response has status code 200 if successful.