Users API

RUSEON Core provides a built-in Role-Based Access Control (RBAC) user management system stored in embedded BadgerDB.

Authentication & Permissions

All /api/users endpoints require a valid JWT token with the admin role.

Role Hierarchy

Role	Permissions
admin	Full system access: add/edit/delete cameras, users, tags, folders, live log stream, system backup/restore.
operator	Operational access: view streams, camera archive, export MP4, add/edit/delete cameras.
viewer	Read-only access: view camera list, live streams, camera archive, server stats, export MP4.
service	Machine-to-machine automation: read streams and telemetry.

---

List Users

Retrieve a list of all registered system users (passwords are automatically sanitized and omitted).

• Method: GET
• Path: /api/users
• Role Required: admin

Response (200 OK)

[
  {
    "username": "admin",
    "password_hash": "",
    "role": "admin"
  },
  {
    "username": "operator1",
    "password_hash": "",
    "role": "operator"
  }
]

Example

curl -H "Authorization: Bearer $ADMIN_TOKEN" http://localhost:8080/api/users

---

Create User

Add a new user with a specified role.

• Method: POST
• Path: /api/users
• Role Required: admin

Request Body

{
  "username": "security_guard",
  "password": "SecurePassword123!",
  "role": "viewer"
}

Response (201 Created)

{
  "username": "security_guard",
  "password_hash": "$2a$10$...",
  "role": "viewer"
}

Example

curl -X POST -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username":"security_guard","password":"SecurePassword123!","role":"viewer"}' \
  http://localhost:8080/api/users

---

Update User

Modify a user's password, role, or both.

• Method: PUT
• Path: /api/users/:username
• Role Required: admin

Request Body

{
  "password": "NewSecretPassword456!",
  "role": "operator"
}

Response (200 OK)

{
  "username": "security_guard",
  "password_hash": "$2a$10$...",
  "role": "operator"
}

Token Invalidation

When a user's role is updated or the user is deleted, their existing active JWT tokens are automatically revoked on the next request via the core's real-time BadgerDB verification check.

---

Delete User

Remove a user account.

• Method: DELETE
• Path: /api/users/:username
• Role Required: admin

Admin Protection

The default admin user cannot be deleted via the API (400 Bad Request: Cannot delete default admin).

Response (200 OK)

{
  "message": "User deleted"
}

Example

curl -X DELETE -H "Authorization: Bearer $ADMIN_TOKEN" \
  http://localhost:8080/api/users/security_guard