Users

Users are the people who sign in to your account. A signed-in user is judged by your pages' authenticated permissions, so users are how you give a team access to drafts and editing. See Publishing and access.

Every user query, listed in the Users API, needs a signed-in user's token, and answers only about your own account.

type User {  id: ID!  username: String!  email: String!  name: Name}type Name {  firstname: String  surname: String}

Every user of your account can see every other, email addresses included. Bear that in mind before inviting people who should not see each other's details.

The signed-in user, or null without one:

query {  me {    id    username    email  }}

One user, by exactly one of id, username or email:

query {  user(email: "ada@example.com") {    id    name {      firstname      surname    }  }}

Everyone, a page at a time. Pass pageInfo.endCursor back as connection.cursor for the next page, while hasNextPage is true. connection.size sets how many come back: 25 by default, and at most 50. A larger size is not an error, it returns 50.

query Users($connection: ConnectionArgs) {  users(connection: $connection) {    edges {      node {        id        username      }    }    pageInfo {      endCursor      hasNextPage    }  }}

Users can edit their own details, and the account's owner can edit anyone's:

mutation {  editUser(    user: {      id: "usr_…"      email: "ada@example.com"      name: { firstname: "Ada", surname: "Lovelace" }    }  ) {    id    email  }}

editUser replaces the details rather than merging them. email and name are both required, so send the user's current values for anything you are not changing.

A signed-in user changes their own password with their current one:

mutation {  changePassword(oldPassword: "…", newPassword: "…") {    id  }}

A user who has forgotten theirs starts a reset by username or email address. It needs no token. Mountain Labs emails the user a link to choose a new password, which works for 30 minutes; asking again replaces the earlier link.

mutation {  resetPassword(user: "ada@example.com") {    success  }}

success is always true, whether or not the address belongs to anyone, so the response never reveals whether an account exists. Tell the user to check their email either way.

Only the account's owner can delete a user, and the deletion is permanent:

mutation {  deleteUser(user: "usr_…")}

Two deletions are refused: the owner's own account, and your own. An account always keeps its owner.